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SET-UP CHECKLIST 
80186/88 


Please read this checklist completely before using your new Applied Micro-_ 
systems” Satellite Emulator. 


l. 


2. 


36 


If 


Have you reviewed the specifications for the serial interface port? See. 
Sections 2.3.3 and 2.3.4. . 


If using communications without a modem, you may need a null nodes cable.” 
Example: : 


6 

gr 

20 ——=20* 
7 7 


*Check the specifications in your terminal manual pesons reversing the 
pins. : _ 


At a minimum, you should review sections applicable to the steps sted 
here, plus "Getting Started With The 80186 or 80188." - 


you experience difficulty in setting up your Satellite emulates” call 


Customer Services for ES products at 1-800-426-3925. 


PLACE CHECKLIST INSIDE FRONT COVER FOR FUTURE REFERENCE 


ETP a 


5020 148th Avenue N.E. 
Redmond, WA 98052 


or 


Box C-1002 
Redmond, WA 98073-1002 
Toll Free Service: 1-800-426-3925 


GETTING STARTED WITH THE 89186 or 89188 


The 84186 or 86188 microprocessors include on-chip peripheral 
circuits which offer many benefits to the user. The addition of 
these on-chip peripheral circuits adds a degree of complexity to 
development workstations not previously. encountered with either 
the 8986 or 8@88 microprocessors. As you might expect, this adds 
greatly to the complexity of emulation, particularly in the area 
of setting up an emulator to run with the target system. 


This document should help identify obstacles to the installation 
and operation of the emulator/target workstation. To help ensure 
a successful and speedy start up, please follow these step-by- 
step instructions. 


STEP 1: SET UP THE EMULATOR/TARGET WORKSTATION 
Connect the emulator to your target. Refer to section 2 
of the Operator’s Manual. 


Apply power to your emulator then to your target system. 


STEP 2: SET UP THE PCB RELOCATION REGISTER 
Note: If you do not relocate the Peripheral Control 
Block from $FF@@ in I/0 space, then go to Step 3. 


ENTER: REL = register-value <Return>*® 


*Refer to an Intel 89186 User”’s Guide for the proper way 
to set up the register. 


STEP 3: . SET UP THE ON=CHIP CHIP SELECT PERIPHERAL 
Note: If you do not use on-chip chip selects, then go 
to Step 4. OS 


ENTER: ON RCS <Return>d 
With RCS set to ON, the following will be true: 


PAUSE-TO~RUN transitions will write the emulator chip 
select PCB values into the target PCB. a4 
RUN-TO-PAUSE transitions will read the emulator chip 
select PCB values from the target PCB. | 


ENTER: Values needed for UMCS, LMCS, MPCS, MMCS and PACS 
- registers, as: UMCS = register value <Return>.* 


*Refer to an Intel 86186 User”s Guide for the proper way 
to set up the register. 


STEP 4: SET UP THE ON-CHIP DMA PERIPHERAL 


Note: If on-chip DMA circuitry is not used, then go on to Step 
5 


Ale 
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ENTER: 


Note: 


STEP 6: 


Note:. 


E NL-E R: 


STEP e: 


Note: 


ENTER: 


Values needed for USRCO, SRCO, UDSTO, DSTO, XCO and CWO 
registers, as: USRCO = register value <Return>.* 


*Refer to the intel 80186 User”s Guide for the proper 
set up. 


If you do not need DMA active while paused, then go on 
to Step 5. 


ON DME <Return> 


SET UP THE ON-CHIP TIMER PERIPHERAL 


If en-chip timer circuitry is not used, then go on to 
Step 6. 

Values needed for TCY, TC1, TC2, MAP, MAL, MA2, MBG, 
MB1, MB2, MCWH, MCWl and MCW2 registers, as: 

TCO = register value <Return>.*® 


*Refer to the Intel 80186 User”’s Guide for the proper 
set up. 


If you need a timer circuit active while paused, then 
turn on the appropriate emulator software switch, as: 

ON TE@ <Return> for timer zero, and/or 

ON TE] <Return> for timer one, and/or 

ON TE2 <Return> for timer three. 


SET UP THE ON-CHIP INTERRUPT CONTROL PERIPHERAL 


If on-chip Interrupt Control circuitry is not used, then 
proceed to Step 7. 


Values needed for INT@, INT1, INT3, EOL, POL, POS, MSK, 
PLM, ISV, IRQ, IST, TCR, DMA@, DMAL, and DMA2 registers, 
as: 

INT@ = register value <Return>* 


*Refer to the Intel 80186 User”’s Guide for the proper 
set upe 


SET UP OVERLAY AND A MINIMAL PROGRAM 


This step assumes you have neither target memory nor a 
valid program located at the startup location (*FFFFQ@). 
If you have target memory and a valid program then go on 
to Step 8. 


MAP SFF8Q@;DM <Return> 


This will map in overlay from $FF8#9 to SFFFFF and 
display the memory map. 


soe 


ENTER: 


ENTER: 


ENTER: 


ENTER: 


ENTER: 


STEP 8: 


Note: 


ENTER: 


Note: 


ENTER: 


ENTER: 


ON RDY <Return> 
This will ensure that Reads and Writes to overlay use 
the emulator’s internal ready signal. 


ASM <Return> 
This will invoke the single-line assembler to enter a 
sequence of NOP instructions. 


CSEG = @FFFF <Return> 
This will set the assembler to an absolute address of 
SFFFFO@. 


NOP <Return> (repeat several times) se 
This throw-away program is used to initialize the 
on-chip peripheral circuitry. 


X <Return> 
This will exit the assembler. 


ACTIVATE THE ON-CHIP PERIPHERALS 


The following tasks should have been accomplished before 

reaching this point: .- 

1) The state of all on-chip peripherals should have 
been set up via the PCB registers. 

2) The emulator’s ON or OFF software switches have been 
properly set up. 

3) A program resides at the start up location (S$FFFFQ). 


ACl = stopping point <Return> 
This will define the stopping point of the program which | 
should follow the initialize section. 


The on-chip peripherals are activated by either a. ‘Read 
from, or Write to appropriate registers. The setting of. 
the emulator”s switches to ON guarantees the chosen 
peripheral registers will be written and read following 
the execution of at least one instruction cycle. There- 
fore, set up ACIl, as either: 


AC] = S$FFFF2 (if manually initializing and using the | 
NOP program in Step 7), ae 
On; 
AC1 = stopping point (if using your own PCB initiali- 


zation program). 
WHEN AC1l THEN BRK . 
This will allow a breakpoint when ACl is recognized 


during emulation. 


RST;RBV <Return> 


RST sends a reset signal to the target system via the 
RESET OUT line. 


RBV sets CS:IP registers to the absolute address of 
SFFFFQ, activates the event monitor system, . and 
initiates a reai-time run. 


This concludes the initial startup procedure. At this point, the 
PCB has been initialized and the emulator set up for further use. 
You should be able to perform normal emulator functions. 


Applied Microsystems Corporation has made every effort 
to document this product accurately and completely. However, 
Applied Microsystems assumes no liability for errors or for 
any damages that result from use of this manual or the equip- 
ment it accompanies. Applied Microsystems reserves the right 
to make changes to this manual without notice at any time. 


Because this configuration of the ES1800 Satellite 
Emulator is intended for use in developing, debugging, and 
testing Intel 80186/88 microprocessor-based systems, it is 
presumed that the user is familiar with the terminology of 
the 80186/88 microprocessors. 


WARNING - This equipment generates, uses, and can 
radiate radio frequency energy and if not installed 
and used in accordance with the instructions manual, 
may cause interference to radio communications. As 
temporarily permitted by regulation it has not been 
tested for compliance with the limits for Class A 
computing devices pursuant to Subpart J of Part 15 of 
FCC Rules, which are designed to provide reasonable 
protection against such interference. Operation of 
this equipment in a residential area is likely to 
cause interference in which case the user at his own 
expense will be required to take whatever measures 
may be required to correct the interference. 
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1.1 SYSTEM CONCEPTS 


The Applied Microsystems ES 1800 Satellite Emulator (Figure 1.1) is 
a controllable microprocessor emulation system. It operates in 
conjunction with your host computer system or as a standalone 
system controlled by a CRT terminal. All system configurations 
provide powerful hardware and software debugging capability as well 
as hardware/software integration support. 


. The Satellite Emulator is transparent to the normal operation of 


1.1.1 Components 


Figure 1-1. 
The Satellite Emulator 


the “target system" (your hardware). Emulation is performed in 
real time--no additional microprocessor cycles are required as a 
result of the emulation process. No target system addresses or I/0 
ports are needed or used and no program or software objects are 
required in the target system address space. There are no hidden 
quirks. You will have no difficulty using the Satellite Emulator 
with your target system, even when critical timing constraints are 
present. The emulator operates at speeds up to the specified clock 
rate and wiil aiso single-step the microprocessor under operator 
control. 


Standard features of the Satellite Emulator include an Event 
Monitor System, Trace Memory and Disassembly and special test 
functions. 


The Satellite Emulator consists of a mainframe, an emulator pod 
assembly and an optional Logic State Analysis pod assembly. 


MAINFRAME. The mainframe houses the emulation control board, the 
memory controller board, the RAM Overlay board, the controller 
board, the trace and break board, and the power supply, as shown in 
Figure 1-2. There are no external panel controls except the power 
switch on the rear panel. The emulation control board configures 
the Satellite Emulator for use with specific microprocessors. It 
resides in the mainframe and contains the electronics unique to the 
specific device it emulates. 


MAINFRAME 


LOGIC STATES ANALYSIS (LSA) 
POD ASSEMBLY 


Figure 1-2. 
Mainframe Components 


1.1.2 The Target 
System 


POWER SUPPLY 


CONTROLLER BOARD 


EMULATION CONTRO 
ON CONTROL BOARD TRACE AND BREAK BOARD 


MEMORY CONTROLLER BOARD (MCB)-NOT SHOWN. It is normally between 
the controller board and the trace and break board. (See Figure 
2-4). 


EMULATOR POD ASSEMBLY. The emulator pod assembly consists of the 
pod, a probe and two cables: 


e The 40-inch ribbon cable connects the assembly to the mainframe; 
the ll-inch ribbon cable connects the assembly to the target 
system. 


e The pod contains the emulating microprocessor and associated 
circuitry (line buffers, etc.). 


e® A special probe tip connects the ll-inch ribbon cable to the 
target system. The probe tip has been designed to be i ae 
with sockets for the 80186/80188. 


The emulator pod assembly is connected internally to the mainframe 
via the emulation control board (see Figure 1-2). 


OPTIONAL LOGIC STATE ANALYZER POD ASSEMBLY. The Logic State 
Analyzer (LSA), via the optional LSA pod assembly, provides 16 
additional input lines to the Satellite Emulator, giving you access 
to signals other than the bus signals. 


The target system is your hardware. The emulator pod assembly is 
connected to the target system by removing the target system micro- 
processor from its socket and plugging the probe connector in its 
place. The emulator then functions as a replacement for the 
microprocessor that was removed, providing a rich variety of 
control and analysis capabilities at the same time. 


Once connected, the emulator is able to communicate with the 
environment that the target system provides for the target system 
microprocessor; the emulator may read or write to the micropro- 
cessor registers or memory locations and it may execute programs 
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1.1.3. The Host 
System 


1.1.4 System 


contained in the target system memory. It makes no assumptions 
about the environment provided by the target system; if the target 
system microprocessor works correctly with the target system, the 
emulator will also, provided that the microprocessor manufacturer’ s 
design specifications are complied with. 


The host system may be a development system, computer, or automatic 
test equipment system. The Satellite Emulator connects to a host 
system via a serial port (labeled "COMPUTER") on the rear panel of 
the emulator mainframe. A second serial port (labeled '"TERMINAL") 
is provided for connection to a CRT terminal. 


The host system can be used to control the emulator or as a source 
of data. This is described in section 1.1.4. 


There are two system configurations: standalone, and standalone 


Configurations with host data files. See Figure 1-3. 


Figure 1-3. 
System Configurations 


STANDALONE. [In this configuration, the Satellite Emulator is 
controlled directly by a CRT terminal, with no external data 
sources or output devices. The terminal serial port on the rear 
panel is the input source for control commands you key in on a CRT 
terminal. See Figure l1-3a. 


STANDALONE WITH HOST DATA FILES. In this configuration, the 
Satellite Emulator is still under the direct control of the CRT 
terminal. In addition, the computer serial port is connected to a 


‘host system for access to the host’s data files. Or, the computer 


serial port can be connected to a printer for dumping data from the 
emulator to create hard copies. You also have available a "trans- 
parent mode," wherein the Satellite Emulator allows communication 
between the computer and terminal ports or output devices connected 
to these other ports. Essentially, the transparent mode uses the 
emulator as an interface or conduit between the two ports. See 
Figure 1-3b. 


CONTROLLING COMMANDOS 
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TERMINAL PORT | 
| 
\ 
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| 


a. STAND-ALONE 
 -OATAFILES\ ‘CONTROLLING cOuMANDS 
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HOST COMPUTER | | 
OR PRINTER EMULATOR |__CRT TERMINAL | 


b. STAND-ALONE WITH HOST DATA FILES 


1.1.5 System 
Features 


Table 1-l. 
Feature Summary 


Table 1-1 summarizes the system features of the emulator. Features 
can be combined in various ways to form an emulation system that 
fulfills your exact needs. Section 3 gives a detailed description 
of how features are combined. 


FEATURE 


Help Menu 


EEPROM Storage 


Emulation 


Trace Memory 


Disassembler 


Event Monitor System 


DESCRIPTION 


Provides you with a display of examples on 
a CRT terminal. See Section 2. 


Allows two users to store complete sets of 
unique, user-defined operating parameters; 
interface parameters, register values, 
macros, switch settings, Event Monitor 
System parameters, and the memory map. 
Parameters can be accessed and changed at 
any time during an emulation session while 
the target system is stopped. See Section 
2° 


Lets the emulator become the target system 
microprocessor and execute the program and 
functions of the target system. See 
Section 4. 


Functions as a history of target system 
program execution. It records each 
bus cycle and can output to a display the 
last 2046 machine cycles. See Section 4. 


Allows you to display the contents of the 
Trace Memory history in a form similiar to 
your program listing. Output can be to 
your CRT terminal, a printer, or your host 
computer. See Section 4. 

Allows you to specify event detectors that 
will cause specified actions to occur when 
the events are encountered during the 
target system program. Possible actions 
are: 

e break emulation 

e qualify trace data 


e increment or reset the pass counter 


e trigger an oscilloscope or other 
instrument 


e switch to other event detectors 
e interrupt to a user routine 


See Section 5. 


Logic State Analyzer Provides external logic signal recording 
(pod assembly option) and event detection capability (16 inputs 
to a 16 x 2046-bit memory). See Section 5. 


Overlay Memory Memory, locatable in 2K-byte segments, 
(options up to 512K- that can be mapped into the address space 
byte total) of the target system. When a portion of 


the target system program is loaded into 
it, the program can be edited, positioned 
as desired, and the program executed as if 
it resided completely in the target 
System. See Section 4. 


Internal Clock Allows you to execute your software with- 
out connecting the emulator to your target 
system. See Section 5. 


Downloading Leads target system memory space with data 
from a host system. See Section 6. 
Uploading Dumps data from the target system address 


Space to one of the Satellite Emulator’s 
serial ports. See Section 6. 


Diagnostic Functions A large number of diagnostic functions and 
routines that can be used in both engi- 
neering and manufacturing environments to 
turn on and test your microprocessor sys- 
tem hardware. Features include memory 
tests, oscilloscope synchronization, and 
signature analysis stimuli. See Section 7 
for a complete list and detailed 
descriptions. 


Macros Up to ten macros can be defined and called 
out. See Section 4.11. 


Software Switches Allow you to set system parameters. See 
Section 3.5. 


1.2 DOCUMENTATION This manual gives you information necessary for setting up and 
operating the Satellite Emulator. 


This first section of the manual introduces the Satellite Emulator 
and provides information on features, options, specifications, 
warranty, and service. The remaining sections are organized as 
follows: 


e Section 2, Installation and Set-Up: procedures for setting up the 
physical connection, interface parameters, initial checkout of 
the emulation system, and pre-operational procedures for setting 
up the system, such as accessing the Help Menu and EEPROM storage 
of parameters and a sample first-time emulation sequence. 


e Section 3, System Syntax and Parameters. 


e Section 4, Operation: procedures for emulation, Memory Mode, 
Overlay Memory, Trace Memory, and error codes. 


1.3 80186/88 
APPLICATIONS 


Table 1-2. 
Applications 


1.4 OPTIONS 


e Section 5, Programming the Event Monitor System: procedures for 
programming the Event Monitor System to your specific needs. 


e Section 6, Interfacing and Communications: procedures for 
communicating between the Satellite Emulator and other units in 
an emulation system, such as uploading and downloading and 
setting system controls. 


e Section 7, Diagnostic Functions: descriptions of and procedures 
for using the built-in diagnostic functions of the Satellite 
Emulator. 


e Section 8, Maintenance and Troubleshooting: procedures for 
routine maintenance and basic troubleshooting of the Satellite 
Emulator. 


e Appendices: serial data formats, glossary, cross-reference of 
number bases. 


e Index 


Your Satellite Emulator is configured for 80186/80188 microproces- 
sors with the appropriate emulation control board and emulator pod 
assembly. The following table lists the microprocessors currently 
supported by the ES series emulators and the emulation control 
board and emulator pod assembly used with each. New devices may be 
added as support becomes available. Contact your Applied Microsys- 
tems Corporation representative when you need additional support. 


EMULATION EMULATOR 

DEVICE CONTROL BOARD POD ASSEMBLY 
Motorola: 

68010 ES-68010B ES~68010P 

68000 ES-68000B ES~68000P 

68008 ES-68008P 
Zilog: 

Z8000 ES-Z8000B ES-Z8000P 

Z8001 ES-Z8001P 

Z8002 ES-Z8002P 

Z8003 ES-Z8003P 
Intel: 

8086 ES-8086B ES-8086P~86 

8088 ES-8086P-88 

80186 ES-80186P-186 

80188 ES-80186P-188 


The following options are available for your emulator. Contact 
your Applied Microsystems Corporation representative for infor- 
mation on prices and ordering. 


e Overlay Memory Expansion: available for adding Overlay Memory 
from 32K-bytes up to 512K-bytes total. 


e Logic State Analyzer (LSA) Pod Assembly: provides 16 input lines 
and one trigger output line. The pod assembly gives you access 
to signals other than bus signals which are recorded simulta- 
neously with the bus signals into the Trace Memory. These 
signals also become part of the Event Monitor System. 


La? 


e Carrying Case: fits mainframe, one pod assembly, 


assembly. 


and LSA pod 


e Symbolic Debug (described in appendix C) 


Other options are available to configure your ES 1800 Satellite 
Emulator mainframe for use with other microprocessor families. See 
your sales representative for more information. 


Table 1-3 lists the specifications of the Satellite Emulator. 
Figure 1-4 shows the dimensions of the mainframe and emulator pod 
assembly. 


1.5 SPECIFICATIONS 


Table 1-3. Specifications 


INPUT POWER PHYSICAL 
- Standard: Mainframe: 

90 to 130 VAC 13.2 cm x 43.18 cm... x 34.29 cm. 
47 to 440 Hz (6.2 in. x 17 in. x 13.5 in.) 
consumption less than 130W 

Optional: Emulator Pod: 
180 to 260 VAC 22.6 cm. x 12.9 cm. x 4.1 cm. 
47 to 440 Hz (8.9 in. x 5.1 in. x 1.6 in.) 


consumption less than 130W 
ENVIRONMENTAL 
) Oo 6) 'o) 
Operating Temperature: 0 C to 40 C (32 F to 104 P) 


Storage Temperature: -40 °C to 70°C (-40°F to 158°F) 
Humidity: 5% to 95% relative humidity, noncondensing 


MAINFRAME 


Target System Connection 
(total length including pod): 
1.5 m (60 inches) 


LSA Pod 
12.4 cm. x 7.9 cm. x 2.3 cm. 


(4.9 in. x 3.1 in. x .9 in.) 


Total Weight: 9.1 kg. (20 lbs.). 


13.5 Shipping: 10.9 kg. (24 lbs.). 
EMULATOR POD ASSEMBLY 
pi nan gs 
A, 
1.6 SS 
LSA POD ASSEMBLY 
ae ae ea 
Figure 1-4. 
Dimensions 


1.6 LIMITED WARRANTY 


1.7 SERVICE 


Applied Microsystems Corporation warrants that the equipment 
accompanying this document is free from defects in material and 
workmanship, and will perform to applicable published Applied 
Microsystems” specifications for one year from the date of ship- 
ment. THIS WARRANTY IS IN LIEU OF AND REPLACES ALL OTHER 
WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING THE WARRANTY OF 
MERCHANTABILITY AND THE WARRANTY OF FITNESS FOR PARTICULAR PURPOSE. 
In no event will Applied Microsystems be liable for special or 
consequential damages as a result of any breach of this warranty 
provision. The liability of Applied Microsystems shall be limited 
to replacing or repairing, at its option, any defective unit which 
is returned F.0.B. to Applied Microsystems” plant. Equipment or 
parts which have been subject to abuse, misuse, accident, altera- 
tion, neglect, unauthorized repair, or improper installation are 
not covered by this warranty. Applied Microsystems shall have the 
right to determine the existence and cause of any defect. When 
items are repaired or replaced, the warranty shall remain in effect 
for the balance of the warranty period or for 90 days following 
date of shipment by Applied Microsystems, whichever period is 
longer. 


Extended warranty programs are available by contract. 


If the unit is to be returned to Applied Microsystems for repairs, 
a repair authorization number will be issued by Applied Micro- 
systems Customer Service for ES products. Call 1-800-426-3925 to 
obtain the necessary return shipment information. 


After expiration of the warranty period, service and repairs are 
billed at standard hourly rates, plus shipping to and from your 
premises. 


SECTION 2 


INSTALLATION AND SET-UP 


UNPACKING AND INSPECTION 
OPERATING VOLTAGE AND GROUNDING 


SYSTEM INTERFACING 


2.3.1 The Rear Panel 

2.3.2 Side Panel 

2.3.3 Serial Port Connector Pin Assignment 
2.3.4 Setting Interface Parameters. 


PHYSICAL CONNECTION 

-4.1 Connection to a CRT Terminal 
-4.2 Connection to a Target System 
SYSTEM POWER-UP AND CHECKOUT 


PRE-EMULATION CHECKLIST AND THE HELP MENU 


2.1 UNPACKING AND 
INSPECTION 


2.2 OPERATING VOLTAGE 
AND GROUNDING 


The Satellite Emulator was inspected and tested for any electrical 
and mechanical defects before it was shipped and adjusted for the 
line voltage you requested. The emulator was carefully packed tx 
prevent any possible damage and should arrive in perfect operating 
condition. Carefully inspect it for any damage that may have 
occurred in transit. If any physical damage is noted, file a clain 
with the carrier and notify Applied Microsystems. Also check tc 


make sure each unit of the Satellite Emulator system is present: 


e the emulator mainframe 
e the pod assembly for 80186 or 80188 microprocessors 
e the emulation control board 
e the mainframe power cord 
e the 80186 and 80188 Operator Manual 
e Optional equipment you may have ordered: 
- Overlay Memory 
- Logic State Analysis pod assembly 
- Symbolic Debug 
- a carrying case 


The following paragraphs describe how to properly set up ar 
emulation system around the Satellite Emulator. 


CAUTION: 


DO NOT OPERATE THE EMULATOR UNTIL 
YOU HAVE COMPLETED THE PROCEDURES 
IN SECTIONS 2.2 THROUGH 2.5. 


The Satellite Emulator is normally set for operation on 90 to 14C 
vAC 50/60 Hz. It is also available for operation on 180 to 240 VAC 
50/60 Hz, if so specified when ordered. 


The emulator is supplied with a three-wire cord fastened to é 
three-terminal polarized plug for connection to a power source with 
a protective ground. The ground terminal of the plug is connected 
internally to the metal chassis parts of the emulator. Electric 
shock protection is provided when the plug is connected to a mating 
outlet with a protective ground contact that is properly grounded. 


WARNING: 


FAILURE TO PROPERLY GROUND THE 
SYSTEM WILL CREATE A SHOCK HAZARD 
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2.3 SYSTEM INTERFACING 


2-3-1 The Rear Panel 


Figure 2-1. 
Rear Panel 


-The emulator has three types of groundse The first is the chassis 


ground that is connected to the metallic enclosure of the unit. 
The second type is the AC protective ground. This ground is de- 
rived from the third (green) wire of the AC power cord. It is tied 
to the chassis ground at the power input filter of the emulator. 
The third ground is the signal ground. This is used as a common 
reference for all DC voltages and is the ground employed by the 
logic circuits. The signal ground is tied to the chassis ground 
(and thus to the AC ground) by means of a jumper at the power 
supply terminal strip. 


NOTE: 
Any target system connected to a Satellite Emulator 
should ideally have independent signal and chassis 
grounds that can be disconnected from each other 
when the target system is connected to the erula— 
tor. If the target system’s signal ground is per- 
manently tied to its chassis ground, a ground loop 
will exist. In some cases this will cause unwanted 
currents to flow through the emulator signal ground 
and may result in electrical noise on data, 
address, and control lines. 


Total elimination of ground loops may not be practical if the 
system also contains peripherals that tie a signal ground to a 
chassis ground. When the signal and chassis grounds can’t be 
separated, a low resistance strap between the emulator chassis and 
the target system chassis can reduce noise on the signal lines. 


The Satellite Emulator will be connected to the target system, a 
CRT terminal, and/or a host system. Two points must be consider- 
ed: (1) the physical connection between the emulator and the CRT 
terminal or host system and (2) maintaining proper grounds 
throughout the system. 


The rear panel of the Satellite Emulator is shown in Figure 2-l. 
The two serial ports are labeled TERMINAL and COMPUTER, to signify 
which is used for connection to a CRT terminal and which is for a 
host system, printer, or other source of data files. Be sure all 
peripherals are connected to the proper serial port. 


Also on the rear panel is a BNC connector for connecting to an 
oscilloscope trigger, the main power switch, a line fuse, and the 
AC power connection. 


TERMINAL PORT COMPUTER PORT 


LINE FUSE 
AC POWER CONNECTION 


2e3e2 The Side Panel The side panel contains the cooling fan for the emulator. See 


2-323 


Figure 2-2. 


Serial Port 
Connector Pin 
Assignment 


Serial Port Connector 
Pinout 


Figure 1-2 for the location. 


CAUTION: 
DO NOT BLOCK THE FAN OPENING WHEN THE POWER IS 
ON. THIS WILL CAUSE THE EMULATOR TO OVERHEAT. 


The line fuse may be replaced if necessary. It is removed by 
turning the fuse holder .ounterclockwise with a small screwdriver. 
Replace with a 3-amp slow-blow fuse for 110-volt operation. 


Figure 2-2 shows the pinout of the serial port connectors. Both 
ports use the same pin assignment. Table 2-1 lists the signals 
present on each pin. Pins without signals shown are not connected 
within the emulator. All assigned pins and voltage levels conform 
to Electronics Industries Association (EIA) RS232C standards. 


Physically, there is no difference between the two ports. However, 
there are many software constraints making it important that 
peripherals are connected to the emulator at the correct port. 


The minimum connection to another unit consists of pins l, 2, 3, 
and 7. Pins 4 and 5, Request to Send and Clear to Send, need not 
be connected unless other units connected to the emulator are using 
them. 


You must be familiar with the pin configurations of your own equip- 
ment, as pins 2 and 3 vary and pins | and 7 are sometimes tied 
together. 

CAUTION: 


CHECK HOST AND CRT CONFIGURATIONS 
BEFORE CONTINUING. 


Table 2-1. 
Serial Port 
Connector Pin 
Signals 


PIN NAME DESCRIPTION 

1 Protective Ground Connected in the emulator to the logic 
ground. 

2 Serial Data Out* This signal is driven to nominal + 12 
volt levels by an RS232C compatible 
driver. 

3 Serial Data In* Data will be accepted on this pin if the 
voltage levels are as specified by RS 
232C specifications and follows the 
format outlined in Section 6.2 of this 
manual. 

4 Request to Send This signal is driven to nominal + 12 

(Out put) volt levels by an RS232C compatible 
driver; it signals other equipment that 
the emulator is ready to accept data on 
this port. 

5 Clear to Send This input to the emulator indicates 

(Input) that other equipment in the system is 
ready to accept data. This signal is 
terminated such that the emulator will 
operate with it disconnected. 

6 Not Used 

7 Signal Ground This pin is connected in the emulator to 


9 to 25 Not Used 


the system logic ground. Note, however, 
that this ground is connected to the 
emulator probe ground pin; when the 
emulator is connected to the target 
system, the target system logic ground 
and the emulator logic ground are 
connected together, and to the ground 
system of equipment plugged into the 
serial ports. 


*NOTE: 


You should be familiar with the pin configuration of 


your own system. 


Some systems receive on pin 2 and 


some on pin 3. It may be necessary for you to rewire 
the cable connecting the units. 


2.3.4 Setting 
Interface 
Parameters 


Figure 2-3. 
Top and 
Front Panel 
Removal 


A thumbwheel switch on the controller card selects the initial 
power-on interface parameters, set up in user-defined groups. 
After power-up, you can override the switch setting with software 
commands described in Section 3.5 of this manual. To select 
parameters, turn BOTH knobs to the left and remove the front panel 
of the emulator to expose the card cage, as shown in Figure 2-3. 
The controller card is the top card in the card cage. 


c scene pity }»}~4~|!O~O!~!”*~*~*”:”C:C 
INTERFACE PARAMETER CONTROLLER CARD 
SWITCH 


Refer to Table 2-2. The term "Factory Default" is used to denote 
an 8-bit word, one stop bit, and no parity. "User 0" and "User 1" 
refer to two operators. This allows two operators to each define 
their own power-up parameters, store them in the EEPROM (see 
Section 3), and recall them on power-up, depending on the switch 
position. "Terminal Control" and "Computer Control" determine 
which port will be active on power-up. 
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Table 2-2. 


Interface Parameter POSITION FUNCTION POSITION FUNCTION 
Switch Settings 0 Factory Default 6 Factory Default 
9600 baud 300 baud 
1 User 0 7 Factory Default 
Terminal Control 1200 baud 
2 User 1 8 Factory Default 
Terminal Control 2400 baud 
3 User 0 9 Factory Default - 
Computer Control 4800 baud 
4 User 1 A Factory Default 
Computer Control 7200 baud 
5 Factory Default B Factory Default 
110 baud 19,200 baud 


C,D,E,F Reserved for 
factory use 


Factory Default = 8-bit word, one stop bit, no parity 
2.4 PHYSICAL Connection to a host system will vary with the application. 
CONNECTION Contact Applied Microsystems Customer Service for ES products if 
you require additional information for your host system. 
2.4.1 Connection to You may need to consult your CRT terminal manual to correctly 
CRT Terminal connect the terminal to the Satellite Emulator. Standard 
parameters are: 


e 9600 baud rate 


e 8-bit word length 


one stop bit 


no parity 

e full duplex 

@ no echo 

e XON and XOFF are recognized. 


Refer to the table above if you need to use a baud rate other than 
9600. 


Connect the CRT terminal to the TERMINAL port of the emulator. 
Make sure your connector pin assignment is compatible with the 
emulator. 


On some CRT terminals, it may be necessary to turn the power off, 
then on, to ensure all switches are read by the CRT terminal 
hardware. 


2.4.2 Connection to 
a Target 
System 
Table 2-3. 


Model Numbers 


connect the Satellite Emulator to a target system 


~~ & 


the procedure 


Verify that the target system power supply voltages are 


Install the proper emulation control board in the mainframe as 
shown in Figure 2-4. See the table below to determine the 
correct board for the microprocessor you are working with 
(your emulator will arrive from the factory with the correct 
board installed if you ordered only one family support; Z8000, 


To 
is as follows: 
Ly 
correct. 
2s 
68000, etc.). 
EMULATION 
DEVICE CONTROL BOARD 
Motorola: | 
68000 ES-68000B 
68008 ES-68008B 
68010 ES-68010B 
Zilog: 
ES-Z8000B ES-Z8000P 
Z8001 o 
Z8002 7 
Z8003 " 
Intel: 
8086 ES-8086B 
8088 - 
80186 ue 
80188 “ 


Figure 2-4. 
Installing the 
Emulator Control Board 


MCB Switch 


EMULATOR 
POD ASSEMBLY 


ES-68000P 
ES-68008P 
ES-68010P 


ES-Z8001P 
ES-Z8002P 
ES-Z8003P 


ES-8086P-86 
ES-8088P-88 
ES-80186P-186 
ES-80188P~-188 


SWITCH SETTING 
ON MCB (Fig. 2. 


Left 
Centered 
Centered 


Right 
Right 
Right 
Right 


Centered 
Centered 
Centered 
Centered 


Memory Controller Board 


4, With target system power off, remove the target system micro- 
processor from its socket and plug in the Probe Tip as shown in 
Figure 2-6. 

CAUTION: 


NOTE CORRECT PIN 1 ORIENTATION 


5. The next section gives power-up procedures. 


LSA POD ASSEMBLY 


Figure 2-5. 
Connecting the 
Pod Assemblies 
To the Mainframe 


EMULATOR POD ASSEMBLY 


PIN 1 
OF SOCKET 


Figure 2-6. 
Installing the 
Probe Tip 
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2.5 SYSTEM POWER-UP 
AND CHECKOUT 


With the emulator properly connected to a CRT terminal and your 
target system, first turn on the CRT terminal, then the target 
system, and finally the emulator. 


The first time you use your emulator, it must be powered up with 
the interface parameter switch in position § or positions 5 through 
B. To ensure the proper switch position, first check the baud rate 
on the terminal, then, if necessary, select the appropriate parame- 
ter switch setting so that the baud rate on the emulator correlates 
with the baud setting on the terminal. We recommend the highest 
rate possible for best response. You can later make and store 
final adjustments for the terminal/emulator interface by using the 
SET & SAVE commands. 


NOTE 


if the interface parameter switch is in any of 
positions 1 through 4, the parameters and register 
values stored in the EEPROM are loaded on power-up. 
See Section 3.5 and Section 2.3.4. 


When the power is first applied to the Satellite Emulator and its 
clock begins operating, a Power-on-reset operation occurs during 
which the following functions are performed: 


l. The microprocessors in the mainframe and pod are both reset. 


Ze The Trace Memory, Event Monitor System, and registers are 
cleared. 


If the interface parameter switch is in any of positions 1 
through 4, the parameters and register values stored in the 
EEPROM are loaded. See Section 3.5 and Section 2.3.4. 


3. The emulator transmits the following message to the terminal: 


COPYRIGHT 1984 

APPLIED MICROSYSTEMS CORPORATION 
SATELLITE EMULATOR 80186 V2.4 
USER =0O0 SW=l1 


4. The processor type is that of the microprocessor installed in 
the pod. The version number reflects the released revision of 
the software in the emulator. The USER number and switch po- 
sition, SW, are determined by the Interface Parameter Switch. 


5. The emulator performs its self test which may take a couple of 
seconds. During this time the emulator determines the amount 
of overlay memory and transmits to the terminal: 


# nK AVAILABLE OVERLAY n=32, 64, 128, 256 or 512 depending 
upon amount of overlay memory installed in the system. 


bo 
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2.6 PRE-EMULATION 
CHECK LIST AND 
THE HELP MENU 


When there is no clock in the target system there will be a 
different message: 


# nK AVAILABLE OVERLAY 
NO CLOCK TYPE "Y'" TO SELECT INTERNAL CLOCK 


If you do elect to use the internal clock type a Y and the 
emulator will respond with a >. 


The > prompt tells you that the emulator is ready to receive 
your instructions. (Always make sure that the > prompt shows 
before you type in a command or you may lose characters and 
the command will fail. You then must re-enter the command). 


NOTE: 


If the > does not appear, turn off all equipment, check 
the connections and then repeat the power-on sequence: 
terminal, target system and emulator. If the > prompt 
still does not appear, contact your Applied Microsystems 
representative. 


Before reviewing the pre-emulation checklist and character set, 
type "CLK" <return> just to verify that your target system clock is 


ok. 


As mentioned previously, before beginning emulation some of the 
features associated with it must be set up. First, review the Help 
feature. 


l. 


At any time after the emulator is operating, you can call up 
the Help Menu by entering the question mark character, "?". 
This feature of the Satellite Emulator is two built-in display 
pages that summarize the operators used and the input form of 
each. Figure 2-7 shows the two displays. To access the first 
display (Figure 2-7a), key in: 

> ? 
To move to the second display, enter: 

> <returm 
To move out of the Help Menu after the first page (without 
viewing the second page), enter any character other than 
€return>. The emulator will return a > prompt and you can 
enter your next command. 


The Help Menu can be accessed at any time as long as the 


emulator responds to input characters and it has not just 
transmitted a "?". 
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Figure 2-7. 
The Heip Menu 


Co A eng 


| R 
>< ? 
RUN/EMULATION: RUN/RNV - RUN/RUN WITH NEW VECTORS 
STP - SINGLE STEP / STOP RBK/RBV - RUN TO BREAKPOINT/WITH VECTORS 
RST - RESET TARGET SYSTEM WAIT ~ WAIT UNTIL EMULATION BREAK 
TRACE HISTORY: DTB/DTF-DISASSEMBLE PAGE BACK/FORWARD 
DT ~ DISASSEMBLE MOST RECENT LINE DRT (X) - DISPLAY PAGE RAW TRACE (FROM X) 
MEMORY - REGISTER COMMANDS: DR - DISPLAY ALL CPU REGISTERS 
DB X TO Y = DISPLAY BLOCK FILL X TO Y,Z - FILL BLOCK WITH Z 
BMO X TO Y,Z - BLOCK MOVE TO Z LOV/VFO X TO Y - LOAD/VERIFY OVERLAY 
MMS = ALT, COD, DAT, STA DEFINES STATUS LINES FOR MEMORY ACCESS 
X - EXIT MEMORY MODE M X ~ VIEW/CHANGE MEMORY AT X 
MEMORY MAPPING: OVE = CD, DTA 
MAP X TO Y :RO : RW :TGT :ILG DM/CLM - DISPLAY/CLEAR MEMORY MAP 
COMMUNICATIONS : TRA - TRANSPARENT MODE TERMINAL-HOST 
DNL - DOWNLOAD HEX FILE FROM HOST CCT - TRANSFER CONTROL TO COMPUTER PORT 


UPL X TO Y - UPLOAD HEX TO HOST TCT - TRANSFER CONTROL TO TERMINAL PORT 

SYSTEM: SET - VIEW/ALTER SYSTEM PARAMETERS 
ON/OFF ~ VIEW/ALTER SWITCHES SF ~ VIEW/EXECUTE SPECIAL FUNCTIONS 
ASM (X) - IN LINE ASSEMBLER DIS(X) DISASSEMBLE FROM MEMORY 


LD/SAV (X) - LOAD/SAVE @=SETUP,1=REGS, 2=EVENTS, 3=MAP,4=SWITCHES (DEFAULT=ALL) 


FIMST PAGE OF HELP MENU 


EVENT MONITOR SYSTEM: 


DES - DISPLAY ALL EVENT SPECIFICATIONS 
CES - CLEAR ALL EVENT SPECIFICATIONS 
DES X - DISPLAY ALL EVENT SPECIFICATIONS FOR GROUP X 
CES X - CLEAR ALL EVENT SPECIFICATIONS FOR GROUP X 
EVENT ACTIONS: 
BRK - BREAK CNT - COUNT EVENT TGR ~- TTL TRIGGER STROBE 


TRC - TRACE EVENT RCT - RESET COUNTER FSI - FORCE SPECIAL INTERRUPT 
TOT - TOGGLE TRACE TOC - TOGGLE COUNT GROUP X ~ SWITCH TO GROUP X 


AC1,AC2 
DC1,0C2 


EVENT DETECTORS - GROUPS 1,2,3,4: 
OR AC1.X,AC2.X - 24 BIT DISCRETE ADDRESS OR INTERNAL EXTERNAL RANGE 
OR DC1.X,DC2.X - 16 BIT DATA, MAY INCLUDE DON'T CARE BITS 


$1,S2 OR S1.X,S2.X - STATUS AND CONTROL - BYT/WRD + RD/WR + TAR/OVL + MEM/IOA 


+ IAK/RIO/WIO/HLT/IF/RM/WM/NBC + ALT/COD/DAT/STA 


LSA - 16 LOGIC STATE LINES, MAY INCLUDE DON'T CARE BITS 

CTL - COUNT LIMIT, ANY NUMBER 1 TO 65,535 

STEP 1 - ASSIGN EVENT DETECTORS STEP 2 - CREATE EVENT SPECIFICATIONS 
AC] = $1234;S1 = BYT + RM WHEN AC1 AND Sl THEN GROUP 2 

ACL.2 = $45764+14*6;DC2.2 = $5608 DC $FF 2 WHEN ACl AND NOT DC2 THEN CNT 


SECONO HAGE OF HELP MwENY | CTL.2 


2.6.1 Parameter 
Set-Up and 
EEPROM Storage 
Overview 


24;AC2.2 = SFOOO LEN $460 WHEN CTL.2 OR AC2.2 THEN BRK 


The Satellite Emulator contains an interface parameter switch that 
allows you to power up the emulator with one of eight sets of 
factory-defined parameters, or one of four sets of user-defined 
parameters. These user-defined and other display and interfacing 
defaults are defined with SET commands. All the data defined with 
the SET commands can be stored in an EEPROM (Electrically Erasable 
Programmable Read Only Memory) located on the controller board. 
The EEPROM can also store register values, parameters for the Event 
Monitor System, terminal characteristics and the memory map for the 
RAM Overlay Memory, the on/off switches and macros. 
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Set-Up 


SET 


Figure 2-8 ° 
Display Format 


SET commands are used to configure Satellite Emulator interface and 
display parameters. A menu display, shown in Figure 2-8, shows the 
general syntax for the commands and what parameters are in effect. 
To access this display, enter: 


>SET<returnm 


>SET 
ES SETUP: SEE MANUAL FOR DETAILS... 


SET #X,#Y - SET ITEM X TO VALUE CORRESPONDING TO Y 
LD 8;SAV @ LOAD/SAVE SETUP FOR CURRENTLY SELECTED USER 


SYSTEM: #1 USER = @; [2,1] 
#2 RESET CHAR = $1A 
#3 XON, XOFF = $11,$13 


TERMINAL: #18 BAUD RATE #14; [(2=119,5=309,18=2490,14=9690] 
#11 STOP BITS 1; (1,2) 
#12 PARITY = @; [9=NONE,1=EVEN, 2=ODD] 
#13 CRT LENGTH = #24 
#14 TRANSPARENT MODE ESCAPE SEQUENCE = $18,$1B 


COMPUTER: #28 BAUD RATE = #14; [7=1200,12=4800,15=19290] 
#21 STOP BITS = 1 
#22 PARITY = @ 
#23 TRANSPARENT MODE ESCAPE SEQUENCE = $1B,$1B 
#24 COMMAND TERMINATOR SEQUENCE = S$08D,$89,$88 
#25 UPLOAD RECORD LENGTH = #32; [1 to 127] 
#26 DATA FORMAT = 2; [G=INT,1=MOS, 2=MOT, 3=SIG, 4=TEK, 5=XTEK] 
#27 ACKNOWLEDGE CHAR = $26 


The following example shows the key sequence for entering SET 
commands. Table 3-5 at the end of Section 3 shows which parameters 
can be defined, and which SET commands require the reset character. 
The reset character is Ctrl Z, unless changed in your system by you 
or a previous user. ; 


Some of the parameters set via SET will go into effect immediately. 
Others will require you to enter a reset character first. You will 
be prompted for these by the display "YOU MUST RESET ME TO INSTALL 
THIS VALUE IN H/W." 


Note that the SET menu display shows what is in effect currently if 
you have not yet changed any parameters. If you have changed some 


but not yet entered the reset character, it will show what will be 
in effect after the reset character is input. 


The generalized key sequence to alter the interface parameters or 
the CRT display format, is: 


>SET<select number>, <value>[ ,value][,value]<returm 


2=13 


Load and Save 


SAV 


The select number selects which attribute will be altered. The 
values entered correspond to the selections displayed in Table 3-5, 
Remember to use decimal-based numbers when entering the select 
number. 


NOTE : 


When scrolling, XOFF (Ctrl S) is used to stop the 

screen and XON (Ctrl Q) turns the scrolling on again. 

You may need to change the defaults for use in the 
transparent mode, for instance. Like all codes 

specified and displayed by the SET command these new values 
can be stored in EEPROM. XON and XOFF are set as follows: 


>SET 3, $10, $12 


In this example, KON has been changed to 1016 and XOFF 
has been changed to 12 


16. 


The EEPROM is partitioned into space for two users (0 and 1). Each 
user’s space is partitioned into six groups: 


e 0 = system set-up (defined via SET) 


e 1 = all the registers in the system and Event Monitor System 
event comparators 


e 2 = Event Monitor System WHEN/THEN statements 

e 3 = RAM Overlay map . 
e 4 = Software Switch Settings, see Section 3.5. 

e 5 = Macros 


A user”’s number is determined by the SET operator described in the 
previous section. Parameters selected with the SET commands are 
stored in the EEPROM with the SAV (Save) command. Once parameters 
have been stored via SAV, they can be called up with the Load 
command. 


When you first receive the machine or when converting it from 
another microprocessor family, you must initialize the EEPROM to 
the proper data by executing a: 


>SAV (no argument )<returm 


The entire contents of the EEPROM of the appropriate user will be 
loaded into the Satellite Emulator automatically on power-up if the 
interface parameter switch is in positions 1, 2, 3, or 4. When the 
switch is in any other position, you must key in a Load command to 
access the data in the EEPROM. 
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Run With 
Vectors RNV 


You can selectively Load or Save the groups of data in the EEPROM. 
For example: 


e To Load or Save all the groups, key in the Load and Save command. 


example: >LD 
>SAV 


e To Load or Save only one group of data, such as just the 
registers, you will key in the group number in addition to the 
command. 


example: >LD1 
>SAV3 


@ To Load or Save a combination of data groups, such as the 
parameters and the registers, you will have to enter two or three 
commands. 


example: >LD2; LD4 
>SAV1; SAV3 


When you enter RNV, the code segment and instruction pointer are 
loaded to their starting values, all other registers are 
initialized to their default powerup values (F defined) and 
emulation is started <returm. 


You will see an R> (the RUN prompt). Most commands can be executed 
from the R>. However, if your command fails and you see a ?, 


follow these steps: 


e Enter ? to get the error message telling you why the command 
failed. 


e If the command failed because it cannot be executed from the R>, 
enter STP. When the > appears, re-enter the command. 


e If the command failed for any other reason, follow the 
appropriate measures to correct. 


e When you input a command to the emulator that it does not 
understand, it will respond with a "?". 


Sample sequence for first-time emulation: 


>RNV Loads target system vectors, begins program execution 

R>STP;DTB Stops program execution and disassembles one page of 
trace 

>STP;DT Steps (executes) one instruction and disassembles it 


DAC] = <address>; WHEN AC] THEN BRK 

>RBK; WAIT; DTB 
Runs program, waits until breakpoint, then 
disassembles one page 


NOTE: Some emulator features that enhance emulation may be set up 
prior to emulation. However, if you are working with the emulator 
for the first time, we recommend following the sequence of commands 
given in Section 4. This sequence starts with the most basic 
commands. 


2-15 


The advanced features that enhance emulation are: 


e Event Monitor System - the Event Monitor System allows you to 
select events within emulation that will cause specified actions 
to occur. These events and resultant actions may be defined 
prior to emulation and are described in Section 5. 


@e Memory Mode - allows you to examine and change contents of the 
target system memory. 


e RAM Overlay Memory - you may wish to map your target system 
program memory and fill it with data. This is described in 
Section 4.5. 


e Trace Memory - special conditions can also be set for the Trace 
Memory. These are described in Section 4.6 


SECTION 3 


SYSTEM SYNTAX AND PARAMETERS 
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3-2 


3.3 


3.4 


INTRODUCTION 


STANDARD CHARACTERS 
3.2.1 The Prompt Character 
3.2.2 The Run Prompt 

3.2.3 Spacing 

3.2.4 Utility Operators 


Return * Repeat Previous Command Line * Statement 
Separator * Argument Separator * Delete Line * Reprint Previous 


Line 


NUMBERS AND BASE VALUES 

3.1 Hexadecimal, Decimal, Binary, and Octal 
3.2 Default Base 

-3.3 Display Base 


3 
3 
3 


ARITHMETIC OPERATORS 
3.4.1 Assignment Operators 

Equal * Parentheses * Indirection 
3.4.2 Two-Argument Operators 


Multiplication * Addition * Division * Subtraction * Modulo * 
Shift Left and Shift Right * Bitwise AND * Bitwise OR 


3.4.3 Single-Argument Operators 


Inverse/One’s Complement * Negation/Two’s Complement * Absolute 


Value 


3.5 PARAMETER SET-UP AND EEPROM STORAGE 


3.1 INTRODUCTION 


3.2 STANDARD 


CHARACTERS 
3.2.1 The Prompt 
Character 
> 
3.2.2 The Run Prompt 


R> 


This section explains how to use ESL, the Satellite Emulator 
control language. The information here will be used in conjunction 
with that given in Sections 4-7. 


NOTE: 


If you are reading this manual for the first time, 

you should familiarize yourself with the contents 

of this chapter. Then you can refer to specific 
sections when you need to use them. New users do 

not need to read all of the information in this chapter 
word for word. 


The Satellite Emulator operates in response to command statements 
made up of operators and arguments. Operator refers to the command 
mnemonic or symbol used (RUN, FIL, etc). Argument refers to any 
additional value you must enter as part of the command sequence, 
Such as an address range or base vaiue. Essentially, the command 
operators form a control language, much like higher-level computer 
languages. And, like a computer language, the operators and 
arguments may be combined in various ways to form many complex 
command "sentences." The Satellite Emulator accepts operators and 
arguments when they are logically combined into a statement. 
Statements can be up to 79 characters long. 


The control software recognizes over one hundred mnemonics 
described in Sections 3, 4, 5, and 6. You have two options in 
entering the mnemonics. Since the software recognizes the first 
three letters and last two digits, you can enter just these, as in 
GRO for group, or you can enter GROUP. Any letters included after 
the first three are disregarded: GROABCD would also be recognized 
as GRO. Note that the limitation on the last two digits only 
refers to those included in operator mnemonics. Other numerical 
values are not limited. 


In the following discussion many examples have been included to 
illustrate the text. Some conventions have been adopted for ease 
of explanation. 


e When an angle bracket <> encloses an expression, it is a required 
entry; for example, <address range> or <value>. 


@ When square brackets [] are used to enclose an expression, it is 
an optional entry; for example, [base value]. 


Standard characters appear throughout all the operations of the 
Satellite Emulator. 


When the Emulator is ready to accept a command statement, the 
prompt character (>) appears on the left margin of the CRT terminal 
screen. In the examples, it should be understood that you do not 
type in the prompt character; it was already supplied by the 
command interpreter, indicating readiness for another input line. 


The Run prompt appears on the CRT terminal to notify you that the 
emulator is in Run mode (emulating). 


32 


3.2.3 Spacing 


3.2.4 Utility 
Operators 


<RETURN> 


CNTL X 


CNTL R 


3.3 NUMBERS AND BASE 
VALUES 


Space characters (the space bar) are used to improve readability. 

Normally, you may enter them at your discretion except as required 

to separate two named items (such as "NOT AC2"). So the statement: 
>GD4 = GD4 + #8 * GD2 <returm 

can also be written as: 


>GD4=GD4+#8*GD2<returm. 


Lower-case characters are converted to upper-case except in the 
Transparent Mode or when using Symbolic Debug. 


The utility operators are used to separate, execute, edit, and 
repeat other commands. These operators are: 


RETURN. The <return> is used to terminate statements and execute 
commands. It must be entered after every statement. It is also 
used to scroll through addresses while you are in the Memory Mode. 
On some CRT terminals, the key may be labeled ENTER. 


REPEAT PREVIOUS COMMAND LINE. When this operator (/) is the first 
character of a line, it repeats the previous command line. When it 
appears anywhere else on a line, it signifies arithmetic division. 


STATEMENT SEPARATOR. The semicolon (;) is used to separate command 
statements that are strung together on one line. 


ARGUMENT SEPARATOR. Just as the semicolon separates command 
statements, the comma (,) is used to separate arguments when more 
than one argument is required to form a command statement. The 
comma is also used to decrement addresses when you are in the 
Memory Mode, where it will be the only operator on a line. 


A colon may be used as a separator for an 80186 family pointer 
type. For example CS:IP will convert the segment and offset to the 
absolute 20-bit address they represent (it is also a map type 
separator). 


DELETE LINE. The CNTL (control key) X command will delete that 
line. 


REPRINT CURRENT LINE. CNTL R will reprint the line you just 
entered. This will be useful to you when you are making a hard 
copy. Don’t confuse this with the / operator - the command is not 
repeated, only reprinted. 


There are three basic types of values used in the emulator: normal, 


Don’t Cares and ranges. The following paragraphs describe each of 
the values in detail. 


o Normal values are simple integer numbers. 
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3.3.1 HEXADECIMAL (S$) 
- DECIMAL (#) 
BINARY (2) 
OCTAL (\) 


3.3.2 Default Base 
DFB 


e Don’t Care values consist of two normal values separated by the 
Don’t Care operator DC. Don’t Care values are best envisioned in 
binary form. The value to the right of DC should have some bits 
set. These bits are used as a mask such that every bit set in 
the right side value causes the corresponding bit position on the 
left value to be ignored. Dont Care values are useful when you 
are working with the Event Monitor system to monitor bit logic 
and are described in Section 5. 


DC1 = SFFQ@G DC SFF 


e Range values consist of two normal values separated by one of the 
range operators TO or LEN. Range values are useful for referring 
to blocks of memory. Also, XRA and IRA can be prefixed to the 
arguments to define external or internal ranges, respectively. 
The default is IRA. 

AC] = G to $7FF 

The base value operators are used to set the numeric base you want 

to work with or to temporarily change the base in effect. On 

power-up the default base is hexadecimal (unless another default 
base has been loaded by the EEPROM on power-up). 


These operators tell the emulator what base a value is in. The 
format is $n, #n, %4n, or \n, where n is any numeric value. The 
base operator preceding n tells the Satellite Emulator that nis in 
that base. They are used any time you want to enter a value in 
other than the default base. Values not preceded by one of these 
operators are presumed by the emulator to be in the default base. 


The following numbers show the format for the different bases: 
e $270F - hexadecimal 

e #9999 - decimal 

e \23417 - octal 

@ £10011100001111 - binary 


The DFB operator is used to display the system default base or 
change the default base in effect (factory default is hexadecimal). 
The Satellite Emulator will attempt to work with any base you set, 
though decimal, hexadecimal, octal, or binary are the most 
meaningful. Numbers without a base prefix are assumed to be in the 
default base. If any number larger than 16 (hexadecimal) or 
smaller than 2 (binary) is assigned, the Satellite Emulator will 
assume the base to be hexadecimal. The following example shows the 
key sequences for assigning default bases. 


e To display the default base in effect: 
>DFB<returm 


e To set the default base to binary: 
>DFB = #2<returm 
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3.3.3 Display Base 
BAS 


e To set the default base to decimal: 
>DFB = #10<returm 


e To set the default base to octal: 
>DFB = #8<returm 


e To set the default base to hexadecimal: 
>DFB = #16 <returm 


e The same format as shown above is used to set the emulator to any 


other base desired between 2 and 16. 


This operator displays the base currently in effect for a specific 
register, as shown in the following example. Displayed bases are 
always shown in decimal: 

e #16 = hexadecimal 


e #10 = decimal 


e #8 


octal 
e #2 = binary 


If it is necessary to have a specific register value displayed in 
other than the default base, you can assign it a "private" display 
base of any number between 2 and 16. Be careful when setting 
private display bases to unusual bases such as 4,7, or 11. The 
Satellite Emulator will operate correctly but the results may be 
confusing. The example also shows how to set private display 
bases. 


If the base value is set to other than hexadecimal, decimal, octal 
or binary, the emulator will display a ? when you ask it to display 
the base in effect--there are symbols only for the four most common 
bases. 


e To display the current default base: 
>DFB<return> 


e To display the base of a specific register: 
>BAS GD3<return> 


GD3 is the name for a specific register that you need to know the 
base of. The emulator may respond with #16 to show that the 
register base is hexadecimal. Note however, that though the 
register is hexadecimal, the base is displayed in decimal: #16 = 
hexadecimal, #8 = octal, #10 = decimal, #2 = binary, etc. 


e If a register has no private display base assigned, the result of 
this command will be 
DEFAULT: fn 
where n is the current default base. 


3.4 ARITHMETIC 
GPERATORS 


Table 3-1. 
Arithmetic Operations 


e To set a private display base: 
>BAS GD3=2<returm 


This sets the display base of GD3 to binary but does not affect 
any other values or the default base (it only affects GD3). The 
next time you display the base of GD3, the CRT terminal will 
respond with: 


#2 


The value of GD3 will always be displayed in binary until you key 
in a different display base or the Satellite Emulator is reset. 
The private display base of any register may be assigned the 
value 0 to cause that value to be displayed in the default base. 


Arithmetic operators can be divided into three groups. 
e Assignment operators are used to assign values. 
e Single-argument operators modify the valve of a single argument. 


e The two-argument operators include the more common arithmetic 
symbols and operators for more specific arithmetic operations. 
Each of these groups have some specific characteristics. Table 
3-1 lists the arithmetic commands and tells which of the three 
groups each falls in. 


GROUP OPERATOR NAME 
Assignment Operators: 

= Equal 

() Parentheses 

@ Indirection 
Two Argument Operators: 

* Multiplication 

+ Addition 

/ Division 

= Subtraction 

MOD Modulo 

& Bitwise AND 

3 Bitwise OR 

<< Shift Left 

>> Shift Right 
Single Argument Operators: 

! Inverse 

- Negation 

ABS Absolute Value 


The following sections describe the properties of the group and the 
commands within each. 
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3.4.1 Assignment 


@ 


Operators 


O 


INDIRECTION. 


Assignment operators assign a value or property to an argument. 
They also extend expressions to include values obtained from com- 
binations of other expressions, or values stored in the target 
system memory address space. 


Generally, the form taken by the result of an operation will be the 
form of the left-hand argument: a Dont Care value times a normal 
value will be a Don’t Care value. There are two exceptions to 
this: 


1. When a normal value appears on the left and a Don’t Care value 
on the right, the result will include Don’t Care bits; 


2. When a normal value appears on the left and an internal or 
external range appears on the right, the result will be a range. 


EQUAL. The equal sign passes the quantity defined on its right to 
the entity on its left. All operations to its right will be per- 
formed before the equality is considered. The entity on the left 
should be a single entity. 


e The equal sign is used as follows: 
>GD3 = $47FF<returm 


The emulator does not display anything in response to this entry, 
but the value you entered at the right ($47FF) is now assigned to 
GD3. . 


e It is also used as follows: 
>GD3 = $121 + $4<returm 


This would first add $4 to $121. GD3 is then assigned the value 
$125. 


PARENTHESES. The emulator recognizes parentheses, just as they are 
treated in algebraic equations: all operations within the 
parentheses are performed first and a single value derived. 


NOTE 


There is no set number of levels of parentheses 
that the Satellite Emulator can work with. The 
only limitation is that statements can be no 
more than 79 characters long. Whatever level 
of complexity you can handle within this limi- 
tation will be handled easily by the emulator. 


The "at" sign is used to express indirection. Indirection allows 
expressions to include values obtained from, or stored to, the 
target system memory address space. The @ operator causes the 
command interpreter to consider the value of the expression 
following to be an address of a target system word; the word is 
accessed and that word--from the target system address 
Space-~becomes the value of the expression. 


It is possible to use more than one @ operator in an expression. 
If two are used, the Satellite Emulator will access the expression 
following the operators and look at the address pointed to; the 
value at that address is then also considered to be an address, and 
that address is accessed and displayed. This gives a means to 
display a quantity that is pointed to by some other quantity 
located in the target system memory. See the example below. 


In this example the dual indirection is used to access a table of 
data that is pointed to by the system stack pointer. 


>@@ SP 
>1234 
CPU SYSTEMS STACK 
REGISTERS RAM MEMORY 
1234 
F306 
SP 


Just as with parentheses, the Satellite Emulator is capable of 
dealing with many levels of indirection. However, again due to the 
limitation that statements not exceed 79 characters, you will 
probably not deal with more than 70 levels of indirection at one 
time. 


e The following two examples help explain using parenthesis and 
indirection together: 
>@GD4 + 6<returm 
>@(GD4 + 6)<returm 


Both contain the indirection operator and the same argument, GD4. 
In the first example, the indirection operator would be applied 
to GD4: the command interpreter accesses the target system 
location pointed to by GD4, adds six to the value stored there, 
and then will display the final result. Instead, if you wanted 
to see the location stored in six locations above the address 
pointed to by GD4, you would use the second example, using the 
parentheses to signify that GD4 + 6 is one entity. 


e It is also possible to use indirection in an assignment function: 
>@(GD4 + 6) = #10 <returm 


This example assigns the number ten to the target system memory 
location which is found six bytes above the location pointed to 


by GD4. 


e The following example is also legal: 
>@(GD4 + 6) = @(GD4 + 8) 
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3.4.2 Two-Argument 
Operators 


Table 3-2. 
Two~Argument 
Operation Validities 


Here, a quantity offset eight bytes from the location pointed to 
by GD4 is copied to a location offset six bytes from the location 
pointed to by GD4. This is a target-to-target move. 


The two-argument operators involve an arithmetic or logical 
operation between two values. The following table lists the two- 
argument operators and the combinations. It is set up as a matrix, 
showing what operations are valid. Refer to this table in the 
following discussion of the individual operators. 


Normal refers to simple arithmetic values. 


NOTE 


Care bits are included, 


in detail in Section 4. 


Left Hand Right Hand 
Argument Argument Operation Result 
Normal Normal * / MOD Valid 
& * Valid 
<< >> Valid 
+ - Valid 
Normal DC MOD ILLEGAL 
x / Don’t Care bits are passed 
to the left hand argument. 
& ~ Don’t Care bits are passed 
to the left hand argument. 
q¢ >? Invalid 
+ - Don’t Care bits are passed 
to the left hand argument. 
Normal IRA, XRA * / MOD Invalid 
& * Invalid 
<< >> Invalid 
+ - The endpoints of the range 
will be altered by the value 
of the normal expression. 
DC DC * / MOD Invalid 
& ~ Invalid 
<< >> Invalid 
+ - Don°t care bits are ANDed 
DG Normal * / MOD Don’t care bits are kept 
& * Valid 
<< >> Don’t care bit positions are 
shifted 
+ - Don’t care bits are kept 
IRA, XRA Normal * / MOD Invalid 
& ~ Invalid 
<< >> Invalid 
+ - The endpoints of the range 
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DC means Don’t 


IRA is an internal address range, 
and XRA is an external address range. 


They are explained 


will be altered by the value 
of the normal expression 


Multiplication and 
Addition 


MULTIPLICATION. An asterisk is used to denote multiplication. 
Multiplication is algebraic--the value to the left is multiplied by 
the value to the right of the * operator. And, as in an algebraic 
equation, multiplication has precedence over addition or subtrac- 
tion in the same equation or statement unless the operator 
separator (;) is used. Multiplication can”“t be performed on 
address ranges. 


ADDITION. Addition is denoted with the addition sign. Like 
multiplication, it operates just as in an algebraic equation. 
Addition can be performed on address ranges and Don’t Cares. 


DIVISION. Division follows the same principles as multiplication. 
It has precedence over addition and subtraction when all are 
contained in one equation or statement. Be careful not to confuse 
the slash operator used for division with the slash used for Repeat 


- Previous Command Line. Both use the same key, but when the slash 


is used to repeat command statements it will be the first character 
on a line. When used for division, it is between two arguments - 
it cannot be the first character on a line. Division can’t be 
performed on address ranges or Don’t Cares. 


Here’s an easy example: 
>GD4 = GD4 + #8 *GD2<returm 
GD4 General Purpose data register 4 


= the equal operator 


GD4 (again) 

+ the addition operator 

#8 a number, written with the decimal prefix 

* the multiplication operator 

GD2 a variable name representing another register 


<returm the return symbol 


The effect of this statement is to read the current value of 
register GD4, add to this value the product of 8 and the value 
contained in GD2, and assign this sum to GN4, thus changing the 
value it contains. 


eo 
| 

oy 

cp) 


MOD 


>> 
<< 


Bitwise And 
Bitwise Or 


SUBTRACTION. Subtraction is much the same as addition. It is 
denoted by the minus sign (-). The minus sign is also used to 
denote negation or two’s complement. 


MODULO. The result of this operation is the remainder after the 
value on the left has been divided by the value on the right. See 
the following example. 


@ >29 MOD 4 
result = l 


e >38 MOD 6 
result = 2 


SHIFT LEFT AND SHIFT RIGHT. These two operations are a movement of 
the bits of a number. For example, a right shift of n places has 
the effect of dividing by, 2" and a left shift of n places has the 
effect of multiplying by 2}. See the following example. 


e A binary shift left: 
>00100000<<1 
result = 01000000 


e A binary shift right: 
>0001000000000000>>1 
result = 0000100000000000 


BITWISE AND. Bitwise And operator (&) functions as a logical AND. 
The & operator infers the ANDing of the bits that form the two 
arguments. 


BITWISE OR. The Bitwise OR operator (*) functions as a logical 
inclusive OR. The operator infers the ORing of the bits that form 
the arguments. 


AND & OR ~ 
INPUT OUTPUT INPUT OUTPUT 
0 60 0 0 O 0 
0 i 0 0 if l 
1 0 0 0 l 
1 l 1 1 1 1 


e Bitwise And: 
>Z00101101 & 210011100 
result = 400001100 


@ Bitwise Or: 
>Z00101101 * 210011100 
result = 410111101 
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3.4.3 Single— 
Argument 


Table 3-4. 
Single-Argument 
Operators 


3-5 PARAMETER SET-UP 
AND EEPROM STORAGE 


Single-argument operators assign a property to the number directly 
following the operator. The following table summarizes the 


at: 


Operators and valid combinations. 


Note that a single-argument operator can even be used before a 
parenthetical operation, and the value within the parentheses will 
be treated as a single value. 


OPERATOR ARGUMENT RESULT 

! Normal Valid 
DC Don’t care bits are not affected 
IRA Complement (IRA becomes XRA) 
XRA Complement (XRA becmes IRA) 

ABS Normal Valid 
DC Don’t care bits are not affected 
IRA Invalid 
XRA Invalid 

- Normal Valid 
DC Don’t care bits are not affected 
IRA Invalid 
XRA Invalid 


INVERSE/ONE“S COMPLEMENT. The exclamation mark is used to signify 
that the following number or value is to be inverted. The inverse 
is the one”~s complement; the inverse of £0010 would be 21101. 
Address ranges can also be inverted: an internal into an external 
and vice versa. 


NEGATION AND TWO°S COMPLEMENT. The minus sign is also used for 
negating a number when used as single-argument operator. This 
operator forms the two”s complement of its argument. 


ABSOLUTE VALUE. The ABS operator converts the following value to 
its absolute, positive value; a negative value would become 
positive, a positive value would remain unchanged. 


As mentioned in the overview in Section 2.3.4, you may set system 
parameters with the SET command. These are listed in Table 3-5, 
which follows. 


You can also set an additional 10 parameters using software 
switches. Nine of these relate to emulation and one determines 
whether or not you can produce hard copy during an emulation 
session. These are listed after Table 3-5 under ON and OFF. 


ES SWITCH SETTINGS MENU 


LD/SAV 4; LOAD/SAVE SWITCH SETTINGS IN EEPROM 
EXAMPLES: >ON BKX+CK 
>OFF FSX+CPY 


VALUE NAME 
OFF BKX 
ON CK 
OFF CPY 
ON FSX 
OFF RDY 
-— DME 
-- TE 
== TE! 
-- TE2 
a= STI 
== RCS 
Figure 3-l. 


ES Switch Settings 
Software Switches 


ON 
OFF 


Break on Instruction 
Execution BKX 


CLOCK 
CK 


FSI on Instruction 
Execution 
FSX 


DESCRIPTION 


BREAK ON INSTRUCTION EXECUTION (NOT PREFETCH) 
SELECT INTERNAL CLOCK 

COPY DATA TO TERMINAL & COMPUTER PORTS 

FSI ON INSTRUCTION EXECUTION (NOT PREFETCH) 
SELECT INTERNAL READY WHEN ACCESSING OVERLAY 
ENABLE DMA DURING PAUSE 

ENABLE TIMER @ DURING PAUSE 

ENABLE TIMER 1 DURING PAUSE 

ENABLE TIMER 2 DURING PAUSE 

ENABLE STEP THROUGH INTERRUPTS 

READ CHIP SELECTS ON RUN TO PAUSE 


The switches used to control emulation and hard = copy 
parameters are enabled using ON and disabled using OFF. 


e To display switches 
>ON 
or 
>OFF 


e To turn on "break on instruction execution" 
>ON BKX 


e To turn off all switches 
>OFF -l 


e To turn on more than one switch 
>ON BKX + FSX + CPY + etc. 


If BKX is ON, an event system break will occur on the instruction 


execution rather than the instruction pre-fetch. 

If clock is ON, the emulator uses an internal clock. 

If clock is OFF, the target system clock is used. 

If FSX is ON, an FSI will occur on instruction execution rather 
than the instruction pre-fetch. Note that if FSX is off, the emu- 


lator may perform several FSIs as the instruction is prefetched 
several times. 
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Copy Switch 
CPY 


Internal Ready 
Switch 
RDY 


Enable DMA 
DME 


Enable Pause Timer 0 


TES 


Enable Pause Timer 1 
TEl 


Enable Pause Timer 2 
TE2 


Step Through 
Interrupts 
STI 


Chip Select 
RCS 


The CPY switch allows the user to enter a copy mode which refers to 
the two ports on the back of the emulator. When the copy switch is 
"on," data sent to the controlling port will also be echoed to the 
other port. This is useful for making hard copy of emulation 
sessions or monitoring computer control (CCT) commands. When CPY 
is off, data is sent only to the controlling port. 


If the ready switch is on, the emulator will use an internally gen- 
erated ready when accessing overlay memory. If the target system 
does not provide a ready signal for addresses that are mapped into 
overlay memory, this switch must be set on. The switch should be 
off when overlaying Dynamic RAM for targets using dynamic memory 
controllers that hold ready inactive during refresh. 


When DME is ON, DMA will be enabled during pause. When it is OFF, 
DMA will be disabled during pause. 


When TE@ is ON, Timer 0 will be enabled during pauses. When it is 
OFF, Timer @ will be disabled during pause. 


When TEl is ON, Timer 1 will be enabled during pause. When it is 
OFF, Timer 1 will be disabled during pause. 


When TE2 is ON, Timer 2 will be enabled during pause. When it is 
OFF, Timer 2 will be disabled during pause. 


When STI is ON, the user may step through interrupts. If it is 
OFF, interrupts will not be serviced while stepping. 


When RCS is ON, the emulator will read the Chip-Select Control 
Registers upon entering PAUSE. This should be turned on only after 
the Chip-Select Control Registers have been set because reading 
enables then. RCS applies to the group of Chip-Select Control 
Registers except UMCS. By writing to an individual Chip-Select 
Control Register during PAUSE, you can enable reading it. For 
example, LMCS = $8000. 


Note: Pause means that the emulator is not in one of the RUN 
modes. 


Table 3-5. 
SET Select Numbers 
RESET CHARACTER 


KEY SEQUENCE DESCRIPTION/RESULT REQUIRED 
SET #1,#0<return> Select User 0 No 
SET #1,#1<returm Select User l No 
SET #2,$n n is the desired reset character No 
SET #3,$n,$m<return> Set values for X ON (n) and X OFF (m) No 
SET #10,#0<returm Set CRT terminal baud rate to 50 Yes 
SET #10,#1<return> 75 baud (CRT terminal) Yes 
SET #10,#2<returm 110 baud (CRT terminal) Yes 
SET #10,#3<return> 134.5 baud (CRT terminal) Yes 
SET #10,#4<returm 150 baud (CRT terminal) Yes 
SET #10,#5<returm 300 baud (CRT terminal) Yes 
SET #10,#6<returm 600 baud (CRT terminal) Yes 
SET #10,#7<returm 1,200 baud (CRT terminal) Yes 
SET #10,#8<returm 1,800 baud (CRT terminal) Yes 
SET #10,#9<return> 2,000 baud (CRT terminal) Yes 
SET #10,#10<return> 2,400 baud (CRT terminal) Yes 
SET #10,#1l<return> 3,600 baud (CRT terminal) Yes 
SET #10,#12<return> 4,800 baud (CRT terminal) Yes 
SET #10,#13<return> 7,200 baud (CRT terminal) Yes 
SET #10,#14<return> 9,600 baud (CRT terminal) Yes 
SET #10,#15<returm> 19,200 baud (CRT terminal) Yes 
SET #11,#1<returm CRT terminal data frame has 1 stop bit Yes 
SET #11,#2<returm 2 stop bits (CRT terminal) Yes 
SET #12,#0<returm CRT terminal parity (send and receive) none Yes 
SET #12,#1<returm Parity even (CRT terminal) Yes 
SET #12,#2<returm Parity odd (CRT terminal) Yes 
SET #13,#n<returm Set CRT terminal lines per page; n=5 to 255 No 
SET #14,$n<returm Specify a 7-bit Reset character. The reception of No 
this character from any port in any mode resets the 
emulator 
SET #15,$n,$m<return> CRT terminal transparent mode escape sequence; n and No 


m are arbitrary character codes; 7-bit ASCII values only 


SET #20,#n<returm> Select computer baud rate; nO to 15 see SET #10,n No 
above 

SET #21,#1<returm Computer data frame has 1 stop bit Yes 

SET #21,#2<return> 2 stop bits (computer) Yes 

SET #22,#n<return> Select computer parity. See SET #12,n above Yes 

SET #23,$n,$m<return> Set computer transparent mode escape characters. See No 


SET #15,n,m 
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SET #24,$n,$m,S$o 
<returm 


SET #25,#n<returm 


SET #26,#n<returm 


Example 3-4. 
Load and Save 


Command terminator for Download; n, m, and o are No 
arbitrary 7-bit ASCII character codes 


Determine maximum number of data bytes in an Upload No 
record; n = 1 to 27 


Select serial data format for Upload and Download; No 
O=Intel, 1=MOS, 2=Motorola, 3=Signetics, 
4=Tektronix, 5=Extended Tekhex 


Example 3-4 shows how to Load or Save system parameters. The loader 
checks the validity of the stored data before transferring it to the 
Satellite Emulator memory. 


The system will save what is shown on the SET menu. The parameters 
shown do not necessarily have to be in effect at the time they are 


rit 


saved. This allows you to use one system to set up default 
parameters for another system. 


NOTE 


A SAV Operation may take up to two minutes. 


Do not interrupt the process. 


e To Load all the system parameters: 
>LD<returm 


@ To Load only one section: 
>LD <m><returm 
The section to be Loaded is denoted by n. 


e To Save all system parameters: 
>SAV<returm 
Remember this may take up to two minutes. 


e To Save only one section: 
>SAV <m<returm 
Again, n is the section number. 
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SECTION 4 


OPERATION 


4.1 INTRODUCTION 


4.2 REGISTER OPERATORS 


4.3 EMULATION 

1 Run 

2 Step and Stop 

3 Run With Breakpoints 

-4 . Vector Loading and Running With Vectors 
5 

6 


Reset 
Wait 
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: 


ORY MODE, I/O MODE 

Entering and Exiting Memory Mode 

Memory Mode and Pointers 

Scrolling 

Word and Byte 

Examining and Changing Values 

Memory Mode Status 

Displaying a Block of Memory and Finding a Memory Pattern 
Display Memory Block * Find Memory Pattern 
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4.5 MEMORY MAPPING AND THE OVERLAY MEMORY 
4.5.1 Memory Block Attributes 

4.5.2 Memory Mapping Operators 

4.5.3 Overlay Memory Operators 


4.6 SOFTWARE DEBUGGING WITHOUT TARGET SYSTEM HARDWARE 
4.7 ERROR HANDLING AND CODES 


4.8 THE TRACE MEMORY AND DISASSEMBLER 
4.8.1 Display Raw Trace 
4.8.2 Disassemble Trace 
4.8.3 Disassemble Previous and Following Trace 
4.9 THE MEMORY DISASSEMBLER 
4.9.1 Display Disassembled Memory 


4.10 THE LINE ASSEMBLER 
4.10.1 Standard Mnemonics 
4.10.2 Assembler Directives 
4.10.3 Usage Notes 
4.10.4 Assemble Line to Memory 


Table 


INTRODUCTION This section describes the procedures for operating the Satellite 
Emulator and error codes that may occur. The information here pre- 
sumes that you have read the previous sections. 

THE SATELLITE EMULATOR WILL NOT OPERATE PROPERLY UNLESS IT HAS BEEN 
CORRECTLY INSTALLED AND SET UP. Information on system communica- 
tions and serial interfacing (beyond initial installation) is in 
Section 6, Interfacing and Communications. 
REGISTER The register operators are used to assign values to registers with- 
OPERATORS in the 80186 and the emulator, and to display these values. 
Table 4-1 lists the registers recognized by the system. 

4-1. 

Registers 

OPERATOR DESCRIPTION HOW USED 

ACI, AC2 address comparator registers 1 and 2 Event Monitor System 

CTL count limit comparator register Event Monitor System 

DC1, DC2 data comparator registers 1 and 2 Event Monitor System 

LSA Logic State Analyzer comparator register Event Monitor System 

Si. S2 status comparator registers 1 and 2 Event Monitor System 

STA Special Interrupt address register Event Monitor System 

OVE Overlay enable register Memory Mode 

MMP memory space pointer Memory Mode 

MMS Memory Mode access status register Memory Mode 

IOP IO space pointer IO Mode 

GDG-7 general purpose data register Miscellaneous 

GRO-7 general purpose range register Miscellaneous 

DFB default base register Miscellaneous 

AX, AL, AH accumulator (low and high) CPU Registers 

BP base pointer CPU Registers 

BX, BL, BH base register (low and high) CPU Registers 

cs code segment CPU Registers 

CX, CG, sCH count register (low and high) CPU Registers 

DS data segment CPU Registers 

DI destination index CPU Registers 

DX, DL, DH data register (low and high) CPU Registers 

ES extra segment CPU Registers 

FLX, FLL, FLH flags register (low and high) CPU Registers 

IP instruction pointer CPU Registers 

SI source index CPU Registers 

SP stack pointer CPU Registers 

SS stack segment CPU Registers 

CWO dma 0 control word PCB Registers 

CWl dma 1 control word PCB Registers 


DSTO dma 0 lower 16 bits of destination address PCB Registers 


DST1 dma 1 lower 16 bits of destination address PCB Registers 
EOL end of interrupt register PCB Registers 
LMCS lower memory chip select register PCB Registers 
MAO timer 0 max count "A" register PCB Registers 
MAIL timer 1 max count "A" register PCB Registers 
MA2 timer 2 max count "A" register PCB Registers 
MBO timer 0 max count "B" register PCB Registers 
MB1 timer 1 max count "B" register PCB Registers 
MCWO timer 0 mode control word register PCB Registers 
MCW1 timer 1 mode control word register PCB Registers 
MCW2 timer 2 mode control word register PCB Registers 
MMCS mid-range memory chip select (base address) 

register PCB Registers 
MPCS mid-range memory chip select (block size) 

register PCB Registers 
PACS peripherial chip select register PCB Registers 
REL relocation register PCB Registers 
SRCO dma 0 lower 16 bits of source address PCB Registers 
SRC1 dma 1 lower 16 bits of source address PCB Registers 
TCO timer 0 count register PCB Registers 
TCL timer 1 count register PCB Registers 
TC2 timer 2 count register PCB Registers 
UDSTO dma 0 upper 4 bits of destination address PCB Registers 
UDST1 dma 1 upper 4 bits of destination address PCB Registers 
UMCS upper memory chip select register PCB Registers 
USRCO - dma 0 upper 4 bits of source address PCB Registers 
USRC1 dma 1 upper 4 bits of source address PCB Registers 
XCO dma 0 transfer count PCB Registers 
Xcl dma 1 transfer count PCB Registers 
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The following interrupt controller registers are used only in iRMX mode 


DMA1 level 3 control register (DMA 1) PCB Registers 
DMAO level 2 control register (DMA 0) PCB Registers 
EOL specific end of interrupt register PCB Registers 
IRQ interrupt request register PCB Registers 
IST interrupt status register PCB Registers 
ISV in service register PCB Registers 
IV interrupt vector register PCB Registers 
MSK mask register PCB Registers 
PLM priority level mask register PCB Registers 
TMRO level 0 control register (timer 0) PCB Registers 
TMR1 level 4 control register (timer 1) PCB Registers 
TMR2 level 5 control register (timer 2) PCB Registers 
The following interrupt controller registers are used in non-iRMX mode 

DMAO dma 0 interrupt control register PCB Registers 
DMA1 dma 1 interrupt control register PCB Registers 
INTO interrupt 0 control register PCB Registers 
INTL interrupt 1 control register PCB Registers 
INT2 interrupt 2 control register PCB Registers 
INT3 interrupt 3 control register PCB Registers 
IRQ interrupt request register PCB Registers 
IST interrupt status register PCB Registers 
ISV in service register PCB Registers 
MSK mask register PCB Registers 


PLM priority mask register PCB Registers 
POL poll register PCB Registers 
POS poll status register PCB Registers 
TCR timer interrupt control register PCB Registers 
DR The Display Registers command is used to display the CPU registers 
in a fixed format. See figure 4-1. Its format is: 
>DR<returm 
oh Ip FLX AX BX Cx DX DS St ES DI BP ss SP 
BOCA: GGGD «0 oe @208 G889 G80 BEBO Bee BBBe BOBO BBG BBD BeBe BORE 
Figure 4-l. 
Display 
Registers 
Format 
4.2.1 Loading A Example: 
Register 
>BX<returm> 
$00000000 


4.2.1.1 Peripheral 
Control 
Block 
(PCB) 
Registers 


4.2.1.1.1 General 
PCB 
Handling 


>BX=5000<returm 


BX<returm 
$00005000 


Because of the dynamic nature of some PCB registers, these are 
handled slightly differently than regular CPU registers (such as 


AX, BX, etc.). (Exceptions to the following procedure are also 
described below.) 


When the emulator exits the RUN mode, all memory and I/0 space is 
searched for the PCB. 


e When the PCB is located, it is moved to locations SFFOO-SFFFF in 
I/O space. 


e All register values are then copied to a table in internal RAM 
and uploaded to the ES controller. These register values are the 
ones displayed in response to the PCB command. 

The values in this table are modified by commands such as: 
MCWO-$1234 


or 


IST=$5678 


4.2.1.1.2 Exceptions 


Timers 


DMA 
Controllers 


Chip 
Select 
Registers 


The commands do not modify the current contents of the physical 
PCB until the next PAUSE-TO-RUN transition. 


When the emulator enters the RUN mode, the PCB register values con- 
tained in the RAM table mentioned above are reloaded into the 
physical PCB. The PCB is then moved back to its location in the 
target address space and the emulator enters the target system. 


The emulator may be configured to allow some or all of the inte- 
grated peripherals controlled by the PCB to continue operating 
during PAUSE mode. 


The ON/OFF switches TE@, TEl and TE2 are used to selectively 
enable/disable the integrated timers during PAUSE mode. 


e If the switch is set to ON, the timer registers are handled as 
described in the general procedure upon the RUN to PAUSE transi- 
tion. On the PAUSE to RUN transition, none of the timer’s values 
are reloaded to the physical PCB, as this would destroy the data 
generated during the PAUSE mode. 


e If the switch is set to OFF (disable time during PAUSE mode), the 
mode control (MCWO) for the particular timer is copied to the RAM 
table upon RUN to PAUSE; the timer is then disabled by clearing 
Bit 15 of the mode control word. Upon PAUSE to RUN, the value in 
the RAM table are reloaded to the physical PCB. This restores 
the timer to its configuration when last running in the target 
system. 


The ON/OFF DME switch selectively enables/disables DMA operation 
during PAUSE mode. Note that all DMA cycles are disabled immedi- 
ately upon RUN to PAUSE transition by the asserting of an NMI to 
the CPU, which then sets Bit 15 of the IST register (DHLT bit). 


e If the switch is set to ON DME: 


-The IST register is copied to the RAM table 

-The DHLT bit is then cleared, causing DMA cycles to resume. All 
DMA cycles are steered to the target system. 

-Upon PAUSE to RUN transition, the RAM table value of the IST 
register will be reloaded to the physical PCB. If you want DMA 
activity to continue when reentering RUN mode, the "RUN" command 
must be preceeded by: "IST = IST & $7FFF" to clear the DHLT bit 
of the RAM table’s IST register value. 

-No DMA register values are reloaded to the physical PCB with 
this setting. 


e if the switch is set to OFF DME, the DMA registers are handled as 
described in "General PCB Handling" 


The ON/OFF RCS switch controls the emulator’s reading of the LMCS, 
MMCS, MPCS, and PACS registers upon RUN to PAUSE transition. 


e If the switch is set to ON RCS, all chip select registers are 
read and restored as described in "General PCB Handling". 
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Interrupt 
Controller 
Registers 


4.2.2 General 
Registers 


4.3 EMULATION 


e If the switch is set to OFF RCS, these chip select registers will 
only be read and copies to RAM table if you have manually set the 
register value during PAUSE mode (i.e. LMCS=1234). This is 
necessary because reading of these chip select registers enables 
them to drive the 80186/88°s chips select lines. 


Upon PAUSE to RUN transition, only the registers that have been 
modified during PAUSE mode (i.e. LMCS=1234) are reloaded to the 
physical PCB. Note that when the switch is OFF, the displayed 
values of the chip select registers (LMCS, MMCS, MPCS, PACS) will 
not show what is actually in the PCB. 


Upon PAUSE to RUN, the poll status register (POS) and its value is 
copied to its own table entry as well as the entry for the poll 
register (POL). This is necessary to prevent setting the IS bit of 


any pending interrupt. Both registers will also show the same data 


in the PCB. 


Because these two registers are Read Only, they are not reloaded to 
the physical PCB upon PAUSE to RUN transition. 


GDO-7 and GRO-7 are miscellaneous registers used to save keystrokes 
when you are using simple integers, ranges or Don’t Cares. They 
are used as follows: 


e GRO-7 integers or ranges for addresses 
e GDO-7 integers or Don”t Cares for data 
Example: 


>GRO=1000 TO 2FFF 
>MAP GRO 
>DM 


>MEMORY MAP: 

>MAP $000000 to SOOOFFF : TGT 
>MAP $001000 to SOO2FFF : RW 
>MAP $003000 to SFFFFFF : TGT 


The basic function of the Satellite Emulator is the emulation of 
microprocessors. When emulation is initiated, the Satellite 
Emulator will run the target system program transparently and in 
real time, just as the target system microprocessor would, or one 
instruction at a time. Essentially, emulation lets you "see" into 
the logical environment of the emulated microprocessor. 


The operators associated with emulation are: 


e Run —- RUN 

e Step and Stop - STP 

e Run With Breakpoints - RBK 
e Wait - WAIT 


4.3.1 Run 
RUN 


4.3.2 Step and 
Stop 
STP 


4.3.3 Run With 
Breakpoints 
RBK 


Run, Run With 
Breakpoints, 
Step, and Stop 


4.3.4 Vector 
Loading 
and 
Running 
With 
Vectors 


Only used to start emulation: 


e Run With New Vectors - RNV 
e Run With New Vectors and Breakpoints — RBV 
e Load New Vectors —- LDV 


To reset processor: 
e Reset - RST (pod only) 


The Run operation executes the target system program in real time 
until you stop it or it encounters an access violation associated 
with the defined memory map. The Run Prompt R> will be present 
during RUN. 


The Satellite Emulator combines Step and Stop into one mnemonic. 
Step takes you through the target system program one instruction at 
a time. Stop is used to break emulation during a Run or Run With 
Breakpoints. 


e If emulation is in progress, keying in STP will cause the 
Satellite Emulator to halt emulation. 


e If STP is entered while emulation is not in progress, one program 
instruction will be executed. Use STP, /, /, /, »+. instead of 
STP, STP, STP, ... it saves typing. 


Run With Breakpoints (RBK) is the same as a Run operation except 
that break operators within the Event Monitor System are honored 
and will stop program execution when encountered. The Run promp R> 
will be present during RBK. 


These examples show how to start emulation: 


e To initiate a Run: 
>RUN<Xreturm 


e To initiate a Run With Breakpoints: 
>RBK<returnm> 


e To stop a Run or a Run With Breakpoints: 
R>STP<returm 


e To Single Step through instructions (emulation not currently in 
progress): 
>STP<returm 


The 80186 microprocessor, when reset, loads the IP (instruction 
pointer) to $0000 and the CS (code segment) to FFFF. The emulator 
can automatically load these same values before going to a run. 
Three commands implement these functions; LDV initializes the reg- 

isters, RNV initializes the registers and begins run, RBV 
initializes the registers and starts run with breakpoints enabled. 
See the following examples. 
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LDV 


Reset 
RST 


e To initialize registers: 
>LDV<returm 


e To initialize registers and run: 
>ENV<return> 
or 
>LDV;RUN<returm 


Note that the two examples cause identical results. RNV 
initializes the vectors, then starts emulation. The same can be 


accomplished using the two commands LDV and RUN. 


e To initialize registers and run with breakpoints: 


>RBV<returm 

or 
>LDV ; RBK 
After an LDV, the registers contain the foilowing data: 
CS = $FFFF IP = $6966 FLX = $F@G2 DS = $6600 
ES = $6009 SS = $6400 REL = $2QFF UMCs = SFFFB 
CWO = $6600 CWl = $6600 MCW = $4000 MCW1 = $060¢ 


MCW2 = $6006 INTO = SOGOF INT1 = SOOOF INT2 = SOGOF 
INT3 = SOQOF TCR = SGOGF DMAG = SOGGF DMAl = S@GGF 
MSK = SQQ@FF PLM = $6607 ISV = $600¢ IRQ = $6000 


Reset is used to reset the microprocessor pod and emulator board 
and also the target. (On all other EM/ES emulators RST does not 
reset the target.) The 80186/88 has two reset pins on it (see 
diagram): 


e /Res (pin 24) is an input to the microprocessor and can be driven 
from both the target and the RST command 


e Reset (pin 57) is an output from the microprocessor and is sent 
back to the target 


When an RST command comes from the controller board, it resets the 
microprocessor and the target hardware as well. One exception to 
this is when the /res pin goes to devices other than the micropro- 
cessor, these devices will not get reset from the RST command. 


Target Pod 
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4.3.6 


Wait 
WAI 


MEMORY MODE 
IO MODE 


4.4.1 


Entering 
and Exiting 
Memory Mode 
M or MM 

xX 

MIO 


The Wait operator causes the Satellite Emulator to delay executing 
the command statement following it until emulation is broken for 
some reason (an event detector within the Event Monitor System or 
access violation of the memory map, for example). See the follow- 
ing example. 


e The format for the Wait operator is: 
>RBK ; WAI ; <command><returm 


e For example: 
>RBK ; WAIL; BX<returm 


e Note that the semicolon is used to separate the commands. 
NOTE 


THE EMULATOR MAY HANG UP WHILE USING THE WAIT OPERA- 
TOR IF EMULATION IS NOT AUTOMATICALLY BROKEN. TO 
ESCAPE THIS CONDITION, USE THE USER-DEFINED RESET 
CHARACTER. 


Memory Mode allows you to examine or change the contents of the 
target system memory. I0 mode allows you to examine or write data 
to IO ports. Each address is accessed and displayed individually, 
with easy-to-use scrolling features. Data at each address can be 
displayed and/or entered in any number base you select. 


The following sections explain how to enter and exit Memory Mode, 
use the pointer, scrolling features, word and byte modes, and how 
to examine and change the target system memory. 


M or MM is used to enter Memory Mode. If no entry address is spec- 
ified, the address will default to the value of MMP. Upon entry, 
the memory location is read and the address and data residing there 
are displayed preceding the prompt. A <returm will increment the 
address. 


MIO is used to enter I/0 mode. If no address is specified, the 
address will default to the value of IOP. Upon entering this mode, 
the ports are not read. The address is displayed preceeding the 
prompt. To read the port, execute a <returnm> as the only character 
on the line. The port will be read and the address and data dis- 
played. The address will not be incremented unless a "." is 
entered. Refer to the following example. 


e To enter the target system memory space at a specific address: 
>M <address><return> 


e To enter the target system memory space at the default address: 
>M<return> 


e To change address while in memory mode: 
$00000000 $FFFF >M <address><return> 


@ The system will respond with one of the two memory mode prompts: 


~ byte mode $000000 SFF> 
- word mode $000000 SFFFF> 
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44.2 


4.4.3 


Memory 
Mode and 
Pointers 
MMP 

IopP 


Scrolling 
NXT 
LST 


e To enter I/O space at a specific address: 
>M10<address><returm 


e To enter I/O space at the default address: 
>M1I0<returm 


e To exit Memory Mode or IO Mode: 
: >x<returm 


The Memory and I/O mode pointers, when invoked, will display the 
last address invoked in Memory or I/O Mode since power-up. The key 
sequence is shown in the following example. 


You can also change the pointers to a value you select by entering 
the desired value before the <returm. 


e To display the last memory address examined: 
>MMP<returm> 


e To change the Memory Mode pointer: 
>MMP=<address><returm 


e To display the last I/O address examined: 
>IOP <returnm> 


e To change the I/O pointer: 
>IOP = <address><returnm 


Once you have entered Memory Mode at a specific address, you can 
scroll to higher or lower addresses. The NXT and LST operators 
determine the default direction of sequential memory accesses. 
When you enter NXT after the prompt, the addresses are incremented 
between each access. LST entered after the prompt causes the 
addresses to be decremented. The power-up default is NXT. These 
commands are useful for storing lists of values into memory. 


When a comma or period is entered in response to the Memory Mode 
prompt, addresses are incremented (with the period) or decremented 
(with the comma) and the next location displayed. These are used 
to temporarily override NXT and LST. 


e To scroll to the next higher [QO Examples: 
address: . @ Scroll to next address: 
<address><data> > NXT <returm <address> > 
or 
<address><data> >. e Display Data: 
or <address> ><returm 
<address><data ><returm <address><data> > 
e To scroll to the next lowest e Scroll to lower address: 
address: <address> >, 
<address><data> >LST<returm 
or 


<address><data >, 
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4.4.6 


Word and 
Byte Modes 
BYM 

WDM 


Examining 
and 
Changing 
Values 


Displaying 
a Block of 
Memory and 
Finding a 
Memory 
Pattern 
DB 


If you wish to scroll through the memory spaces one byte (8 bits) 
at a time, invoke BYM. WDM is used to scroll in the word mode (16 
bits). The system will default to a byte mode. 


BYM and WDM should be considered global defaults that affect all 
operations, not just Memory Mode. 


e To scroll in the byte mode: 
> BYM 


e To return to the word mode: 
> WDM 


Now that you can access Memory and I/O Modes, work with the point- 
ers and scroll higher and lower in either the byte or word mode, 
it”s time to discuss how to change values. 


When you enter an address or scroll to a new address, the CRT ter- 
minal will display the new address (and its value if in memory 
mode). To change the value, simply enter a new value followed by a 
<return>. A string of values can also be entered, each separated 
by a comma. This will store the values to consecutive locations 
according to the current NXT or LST mode when in memory mode. In 
I/O mode a string of values will be stored at the same address. 
The maximum length for a string of values is 9. 


e To change a single value at one location: 
<address><data>> $47FF<returm 


e To change a series of values at consecutive locations: 
>M<address> <return> 
The emulator will respond with: 
<address> <current data>> 
Then enter: 
<address><data@ >$1,$2,$3,$4<returm 


The emulator loaded the first location with 1, the second with 2, 
the third with 3, and the fourth with 4. The address increments to 
the next location following the last word that received data (ac- 
cording to current NXT or LST mode). 


Two additional operators need explanation at this point. Though 
you cannot be in Memory Mode when you invoke them, these operators 
affect memory examination. 


DISPLAY MEMORY BLOCK. To display a block of memory, use the DB 
operator. The display format includes line address and hexadecimal 
data; ASCII-equivalent characters are displayed when in byte mode. 


e To display a block of memory: 
>DB <address range> <returm 


e To display a page of memory starting from a specified address: 
>DB<address><returm> 


Fig 


4.5 


FIN 
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MEMORY 
MAPPING AND 
THE OVERLAY 
MEMORY 


e To display a page of memory starting from the ending address 
of the previous DB command: 
>DB<returm 


e To easily scroll through memory use the slash "/" following a 
DB<returm command. 


FIND MEMORY PATTERN. To find a specific bit pattern in memory the 
FIN operator is used. 


e To find a bit pattern in memory: 
>FIN <range>, <data> <returm 


e To find a bit pattern using Don“t Cares (either form): 
FIN 1000 TO 2FFF, 60XX 
or 
FIN 1000 LEN 1000, 6000 DC OFF 


The emulator will return: 
$<Xaddress> = <data> 
to indicate where the bit pattern has been found. 


>BYM 
>DB @ LEN 38 a 
@G0006 8G 48 45° 4c 4c 4F 80 80 - 2F OF Fl FO SE 2F F6 FO .HELLO../...*/.. 
@2001G GF 03 FO 40 OF OC FZ 49 - B7 B6 FH 9B BF BC DB BB ...@...@........ 
@69020 FF OF FF FO FF 1F FF 7F - FF 3F FF BD FF IF FF FF .....-.+- Pasar | 
> 
>WDM 
>DB @ LEN 30 
@20006 4889 4€45 4F4C 8880 - GF2F FOF1l 2F5E FOF6 
@00010 4=96§« G30F 40FG OCOF 40FO - 607 YGFH GBCOF BODEB 
03020 4 OFFF FOFF 1FFF 7FFF - 3FFF BDFF 1FFF FFFF 
> 
> 


Memory mapping is used in conjunction with the Overlay Memory. If 
you wish to use the Overlay Memory during emulation, you will need 
to define the memory map first. 


The overlay memory is available to the target for DMA only when us- 
ing the ON-chip DMA controller. If an external DMA scheme is used, 
it cannot access the overlay. The overlay memory is accessible to 
the target system whenever it is mapped. An exception to this rule 
is DMA. During External DMA or other non-CPU activity times, the 
Overlay Memory is not available to the target. (Internal DMA 
within the 80186/188 still has use of the Overlay.) 


The Overlay Memory is RAM in the Satellite Emulator with appropri- 
ate address and control logic. It is locatable in 2K-byte segments 
throughout the system. Size of the Overlay Memory ranges from 
32K-bytes to 512K=bytes, depending on the option you selected at 
time of purchase. 
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4.5.2 


Memory 
Block 
Attributes 


:TGT 


Memory 
Mapping 
Operators 


MAP 


The Overlay memory can be mapped into the address space of a target 
System so you can load the target system program into it; the tar- 
get system program can then be edited, positioned in the target 
system address space as desired, and the program executed in real 
time as if it resided totally in the target system. Overlay Memory 
is also useful for checking programs not yet committed to PROM. 
When programming data is correct, it can be uploaded to a PROM 
programmer. 


The first step in using the Overlay Memory is assigning one of four 
attributes to the memory ranges. The ranges specified must fall on 
2K-byte boundaries. If you specify a range that does not, the 
Satellite Emulator will expand the range until the endpoints fall 
on such a boundary. 


The following paragraphs describe the attributes of the four types 
of memory blocks possible. 


NOTE : 


The memory block attribute operators, :RO, :RW 
:TGT, and :ILG, are always preceded by a colon. 


READ ONLY. Memory blocks marked with this attribute are write- 
protected: no target system write cycle can change the data. Note, 
however, that the emulator can write to that space. This is most 
often used to emulate instruction memory that would be placed in 
ROM or PROM. If a write cycle is made to a memory block that has 
this attribute, a write access violation breakpoint stops program 
execution and displays a message to that effect. 


READ/WRITE. Memory blocks marked with this attribute are available 
for read or write access. No error breakpoints ever occur as a 
consequence of access to these blocks. 


TARGET. Memory blocks marked with this attribute are assigned to 
the target system. All memory accesses marked target by the micro- 
processor go directly to the target system memories (if any). 


ILLEGAL. Memory blocks marked with this attribute are illegal for 
all types of access. Normally these blocks are useful for marking 
memory that should never be referenced by the program at all. In 
other words, if the program references these addresses, there is 
something wrong with the program. If this ever occurs, a memory 


‘aecess violation breakpoint will stop program execution and display 


a message to that effect. 
Three operators are used in conjunction with the memory type opera- 
tors for memory mapping. 
SET MEMORY MAP. The MAP Operator is used in conjunction with the 


memory type operators (Read Only, Read/Write, etc.). 


e The general format for setting up a block of overlay memory is: 
>MAP <range> [:memory type]<returm 


Figure 4-3 e 
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e To set a memory space as Read Only, $3000 bytes long, responding 
to addresses 0 to $2FFF: 
>MAP 0 to $2FFF :RO<returm 
This would contain 6 blocks of 2K bytes each. 


e The same format is used for setting any other of the four memory 
types. If the memory type argument is not supplied, the default 
is read/write (:RW). 


DISPLAY MEMORY MAP. This operator allows you to display the memory 
map currently in effect. 


e To display the memory map in effect: 
>DM<returnm> 


CLEAR MEMORY MAP. This operator clears the memory map currently in 
effect. Be sure you are ready to clear it before invoking the 
operator. 


e To clear the memory map in effect: 
>CLM<Creturm> 


>MAP @:RO 
>DM 

MEMORY MAP: 

MAP $8@8880 TO $@007FF : RO 

MAP $08080@ TO S$FFFFFF : TGT 


Overlay Memory ENABLE. The OVE operator allows you to load values 
that determine which memory status space the Overlay Memory re- 
sponds to. The possibilities are Code Space (CD) and Data Space 
(DTA). The current value is shown when the memory map is dis- 
played. Factory default is CD + DTA. 


e The general format for OVE is: 
>OVE = CD + DTA <returm 


LOV. LOV loads Overlay with your target system program. The data 
is automatically verified during the operation. (The target is not 
written to.) 


The key sequence for loading the Overlay Memory is given in the 
following example. The argument specifies the address range of the 
target system memory from which to move data to the Emulator 
Overlay Memory. 


The key sequence is: 
>LOV X TO Y<returm 
or 
>LOV X LEN W<returm 
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VFO. VERIFY OVERLAY MEMORY. VFO is used to verify that the pro- 
gram you have loaded into Overlay Memory matches the program in 
your target system memory. The following example shows the key 
sequence. 


e The key sequence is: 
>VFO X TO Y<returm 


e If any differences occur, the emulator will return: 
<address> = XX NOT YY 


The <address> is where the misverify occurred. XX denotes the data 
present in Overlay Memory and YY is the data at that location in 
target system memory. 


FILL. FIL is used to fill the memory space of the emulator or tar- 
get system with a constant. The constant may be written to overlay 
memory and target read/write memory. 


The format for the Fill operator is: 
>FIL X TO Y, Z 
or 
>FIL X LEN W,Z 


The first argument specifies the address range to be filled with 
the constant specified in the second argument. The second argument 
may be byte or word, depending on the global default. 


VERIFY BLOCK DATA. The VBL operator is used in conjunction with 
the FIL operator. Once the Overlay Memory has been filled with 
constant data (via FIL), this data can be verified with the VBL 
command. The key sequence shown in the following sequence is much 
like the key sequence for FIL. 


The general format is: 
>VBL <address range>, <argument><returm 


The VBL operator verifies that the address range contains the 
argument. 


The Block Move operator moves a block of data from one location 
within the targét system memory or Overlay Memory to another via a 
source/ destination format. The space you move data into should be 
designated as writeable. 


The format for a block move is: 
>BMO<source range> 
<destination start address>,<returm 
>GR1=$LEN266 
>BMO GR1, $666 


e You can verify byte data between the target and Overlay Memory: 
>VBM 2000 TO 3FFF,2010 


Verify Block Move has the same syntax as Block Move except that 
VBM only verifies that the source and destination blocks are 
identical. 
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Figure 4-6. 
Error 
Recognition 


Table 4-2. 
Error Codes 


MESSAGE DISPLAYED 


EXPRESSION HAS NO 
OF THE COMMAND 


PARSE ERROR 


An added feature of the Satellite Emulator is its ability to debug 
software without being physically connected to your target system. 
This is accomplished by using an internally generated clock. 


The procedure consists of mapping memory space and loading the 
Overlay Memory with your program. You can now use the features of 
the emulator to execute program code and test modules. 


When an error occurs during operation of the Satellite Emulator 


with a CRT terminal, the system will print a question mark (?) on 
the screen, directly below or just after the point in the input 
character stream that caused the error. See Figure 4-6. 


>HELLO 
@ 


>? 
ERROR #5 
UNDEFINED SYMBOL OR CHARACTER DETECTED 
> 
> 
>SET GD@=8 LEN 69 
? 
>? 
ERROR #29 
ILLEGAL DESTINATION - SOURCE TYPE MIX 


>MAP @ TO OFFFFFF 
? 
>? 
ERROR #9 
NO (MORE) OVERLAY RAM AVAILABLE 


COMMENTS 


MEANINGFUL RELATION TO REST Often caused by entering symbols out 
of context. DR and BRK are both 
legal operators but entered together 
as DR BRK would cause this error 
message. 


Call Customer Service 


UNDEFINED SYMBOL OR INVALID CHARACTER Generally caused by improper 


DETECTED 


CHECKSUM ERROR IN 


spelling. 


DOWNLOAD DATA The last record received was in 
error. Make sure that the format 
selected in the system setup is the 
same as that of the received data. 
Refer to download for error handling 
during computer control. 


BAD STATUS = ..eRETURNED FROM EMULATOR Contact Applied Microsystems Techni- 


CARD 


cal Services Department. 


hm16 


10 


11 


13 


14-16 


17 


18 


19 


20-23 


24 


25 


26 


27 


28 


29 


31 


32 


33 


ARGUMENT IS NOT A SIMPLE INTEGER 
OR INTERNAL RANGE 


NO (MORE) OVERLAY RAM AVAILABLE 


MULTIPLY-DEFINED EVENT GROUP 


ILLEGAL ARGUMENT TYPE FOR EVENT 
SPECIFICATION 


ARGUMENT MUST BE A SIMPLE INTEGER 


OPERATION INVALID FOR THESE ARGUMENT TYPES 


SHIFT ARGUMENT CANNOT BE NEGATIVE 
TOO MANY ARGUMENTS IN LIST...(9 MAX) 


INVALID GROUP NUMBER...(NOT IN 1-4) 


OPERATION INVALID FOR THESE ARGUMENT TYPES 


BASE ARGUMENT MUST BE A SIMPLE INTEGER 


“DON“T CARES” NOT ALLOWED IN I/O DATA 


RANGE TYPE ARGUMENT NOT ALLOWED AS DATA 


ADDRESS ARGUMENT MUST BE A SIMPLE INTEGER 


ILLEGAL MODE SWITCH ATTEMPT. 


ILLEGAL DESTINATION - SOURCE TYPE MIX 


RANGE START AND END ARGUMENTS MUST BE 
SIMPLE INTEGERS 


RANGE END MUST BE GREATER THAN RANGE START 


RANGE START AND END ARGUMENTS MUST BE 
SIMPLE INTEGERS 


Don’t Cares are not allowed in this 
context. 


You have not cleared the map or you 
are trying to map in more memory 
than is allowed.* 


Only one group may be referenced in 
any event clause; caused by trying 
to mix event register groups in an 
event clause e.g., 2 WHEN AC1.3 THEN 
BRK would cause this error. 


Often caused by attempting arithme- 
tic operations on incompatible vari- 
ables, e.g., (4 DC 9) + (IRA 500 to 
700). Same as error 23. 


See error 14-16. 


Argument should be #0 to #16. 


Can“t enter I/O mode from memory 
mode ad vice versa. 


Caused by trying to store don’t care 


data into a range variable and other 
similar operations. 


6 LEN 1 is not a valid range. 


*Contact Applied Microsystems for optional Overlay Memory expansion. 


is 


CODE MESSAGE DISPLAYED COMMENTS 

34 READ AFTER WRITE-VERIFY ERROR Downloaded data is verified on a 
byte-by-byte basis. The error 
message contains the location and 
results of the comparison. 

35. WARNING - DATA WILL BE LOST WHEN Caused by attempting to store into 

EMULATION IS BROKEN CPU registers during emulation. CPU 
registers are copied into internal 
RAM only when emulation is broken. 
The RAM contents are copied into the 
processor only when emulation is be- 
gun. The emulator cannot access CPU 
registers during emulation. Thus, 
once emulation has been started, the 
DR command will show the contents of 
the CPU registers as they were be- 
fore emulation was begun. Changes 
can be made to these values but the 
data will be rewritten when emula- 
tion is broken. 

36-38 NO ROOM...BREAKPOINT CLAUSES TOO 

NUMEROUS OR COMPLEX 

39 INVALID GROUP NUMBER...(NOT IN 1-4) 

40 ILLEGAL SELECT VALUE First argument after SET operator is 
invalid. 

41 INCORRECT NUMBER OF ARGUMENTS IN LIST 

42 ILLEGAL SETUP SET VALUE The argument nearest to the '"?" 
illegal. 

43 WHEN CLAUSE REDUCED TO...NULL FUNCTION Caused by such constructs as "WHEN 
AC] AND NOT AC1." 

44 INTERNAL ERROR...NULL SHIFTER FILE Contact Applied Microsystems. 

45 MAP CANNOT BE ACCESSED DURING EMULATION The map hardware is constantly used 
by the emulating processor during 
emulation, 

46 ARGUMENT MUST BE AN INTERNAL RANGE 

47 16 BIT RANGE END LESS THAN START 

48 ILLEGAL MODE SELECT VALUE 

49 INVALID GROUP NUMBER...(NOT IN 1-4) 

50 INVALID GROUP NUMBER...(NOT IN 1-4) 

51 SAVE/LOAD INVALID ARGUMENT VALUE 

52 DISPLAY BLOCK NEEDS AN IRA ARGUMENT 


{> 
l 
ps 


co 


CODE MESSAGE DISPLAYED 


COMMENTS 


53 


54 


55 


56 
57 
58 
59 
60 
61 
62 
63 


64 


65 
66 
67 


68 


70 


71 


72 


74 


EEPROM WRITE VERIFY ERROR 


ATTEMPT TO SAVE/LOAD DURING EMULATION 


EEPROM DATA INVALID DUE TO INTERRUPTED SAVE 


TRACE DATA IS INVALID DURING EMULATION 
INVALID GROUP NUMBER (NOT 1-4) 

IMPROPER NUMBER OR ARGUMENTS 

ARGUMENT MUST BE AN INTERNAL RANGE 

ARGUMENT MUST BE A SIMPLE INTEGER 

IMPROPER NUMBER OF ARGUMENTS 

CANNOT STORE THIS VARIABLE DURING EMULATION 
ILLEGAL ARGUMENT TYPE 


ARGUMENT TOO LARGE 


ILLEGAL RANGE 
STATUS CONSTANTS CANNOT BE ALTERED 
TOO MANY "WHEN" CLAUSES 


INVALID DATA FORMAT FOR SYMBOLS 


CANNOT INITIALIZE VECTORS DURING EMULATION 


UNKNOWN EMULATOR ERROR 


INCOMPATIBLE EEPROM DATA 


COMMAND INVALID DURING EMULATION 
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Data in the EEPROM is verified dur- 
ing the SAV operation. (The store 
Operation is retried many times 
before the error is’ generated.) 
EEPROMs have a finite write cycle 
life. The EEPROM in your emulator 
is warranted for one year. Contact 
Applied Microsystems for service. 


Previous SAV was interrupted by a 
reset or power off. 


Caused by entering range or integer 
values with the DRT command that 
include numbers greater than #2045. 


Symbols must be up/down-loaded using 
Extended Telchex format. The format 
specified in the setup menu is not 
Extended Telchex. 


Typed LDV, RNV, RBV during 
emulation. 


Call Applied Microsystems. 


Previous data save was not from 8086 
or 80186 emulator system. 


CODE MESSAGE DISPLAYED COMMENTS 

75 INVALID RECORD TYPE Download routine received invalic 
record type code. 

76 NO SYMBOLIC DEBUG 

77 UNDEFINED SYMBOL OR CHARACTER DETECTED 

78-80 TOO MANY SYMBOLS 

81 SYMBOL OR SECTION PREVIOUSLY DEFINED The ES will load ail symbols pre- 
ceeding the duplicate symbol into 
its symbolic RAM. When you then 
type the command SYM, these will all 
be displayed in the order that they 
were downloaded. The symbol on the 
end of the list can be found in your 
download file, and the symbol imme- 
diately following it will be the one 
that caused the error. 

82 SYMBOL NAME IN USE 

TYPE CONFLICT WITH DEFINED SYMBOL 

87 SECTION TABLE FULL 

88 INVALID ARGUMENT SIZE 

89 INVALID ADDRESSING MODE 

90 ARGUMENT OUT OF RANGE 

94 ARGUMENT NOT SYMBOLIC 


NO BUS CYCLES 


SYSTEM RESET ERROR 


No ALE”’S were detected for at least 
2.2 ms or longer. The controller 
checks then for other fault condi- 
tions: checking to see if the CPU 
is halted, waiting, reset is assert- 
ed or if the bus has been granted. 
If any of these other conditions 
exist then the appropriate message 
for that condition would be display- 
ed. If no other fault condition is 
found then “NO BUS CYCLES” will be 
displayed. 


When a reset has been asserted from 
the controller and the emulator does 
not report back that a reset has 
been asserted then this message will 
be displayed (also when reset has 
been deasserted and the emulator 
does not report back to the control- 
ler that the reset has been 
deasserted). 


CODE MESSAGE DISPLAYED 


COMMENTS 


ere rr SS stupas 


POD CPU NOT INITIALIZED 


POD CPU NOT RESPONDING 


RESET ASSERTED 


NO TARGET POWER 


PROCESSOR WAITING 


HOLD ACKNOWLEDGE ASSERTED/BUS GRANTED 


Whenever a reset occurs (power up, 
“Z,RST), the controller and the emu- 
lator will begin an initialization 
routine to establish communication. 
If this initialization routine fails 
to complete, this message will be 
displayed. 


Whenever a STP, MM XXXX, or MIO XXXX 
is executed the controller will 
check to see if an error occurred 
during the command. If no error 
occurred then it looks to see if the 
command completed. If the command 
did not complete then the controller 
looks to see if the CPU is still 
running. If the CPU is not running, 
an appropriate error message will be 
displayed. If the CPU is running, 
this message is displayed. 


This indicates that a reset from a 
target system has been asserted for 
greater than 1/2 sec. When the re- 
set is deasserted then the message 
will be removed. However, if the 
reset is less than 1/2 sec., then 
the message will not be displayed. 
This message is intended as an error 
reporting condition. 


If the +5v supply in the target sys- 
tem is at approximately +4v or less 
then this message will be displayed. 
The message will be removed when the 
fault condition has been corrected. 


This means that the CPU is waiting 
for a RDY (either ARDY, SRDY, or 
internal rdy) to come back. This 
message will be displayed only if 
the cpu has been waiting for greater 
than 2.2ms. When the condition has 
been corrected then the message 
will be removed. 


This message will be displayed when 
a hold acknowledge has been asserted 
for greater than 2.2ms. This mes- 
Sage will be removed when the CPU is 
given back the bus. 


CODE MESSAGE DISPLAYED COMMENTS 


PROCESSOR HALTED 


NO CLOCK 


A HLT instruction has been executed 
and has been asserted for greater 
than 2.2ms. This message will be 
removed when the CPU is given back 
the bus. 


The CPU clock must have a period of 
lgus or faster to prevent this mes-~ 
sage from being displayed. The 
message will be removed when this 
error condition has been corrected. 


4.8 


THE TRACE 
RX AND 
DISASSEMBLER 


The Trace Memory records the history of the program execution. It 

may be used in conjunction with a disassembly routine to format the 

trace data. The mnemonics provided by the disassembled display en- 
sure more rapid analysis of your data. 


During emulation, the activity of the executing program is recorded 
continuously and stored in the Trace Memory. At any point in the 
process, the program execution can be stopped. The address, data, 
and control signals of the last series of cycles can be displayed 
and scrolled on a CRT terminal or output to a printer. The entire 
contents or a "window" of cycles occurring between specified bus or 
instruction cycles can be dumped. If something unexpected happens 
during program execution, the Trace Memory provides a record that 
can be reviewed to determine what happened. The Event Monitor 
System can be used to qualify, start recording of data into the 
Trace Memory, and stop the recording process. 


The Trace Memory is 72 bits wide and 2048 words deep; two words are 


used for marks, leaving 2046 words. It cannot be accessed by the 
user during emulation. 


A trace counter supplies the address to the Trace Memory and can be 
incremented with each cycle. It is a 12-bit counter (only eleven 
are used) with count mode logic. It has three modes of operation: 


e count never 
@ count every bus cycle (only available during a Run mode) 
& count every bus cycle when qualified by trace directive from 


the event monitor system (only available during a Run mode). 
(See Section 5). 


A Disassembler is available for use with the Trace Memory. This 
allows you to display or print Trace Memory in an easy-to-read for- 
mat similiar to a program listing. Figures 4-4 and 4-5 show print- 
outs of the Trace Memory and of the Trace Memory with Disassembly. 
When printed, the disassembler writes over the line which invokes 
it. This may cause overstriking on your printout. 


A "page" of Trace Memory is defined as the number of lines on the 
CRT terminal, less three. All scrolling is done by pages, with 
both raw Trace Memory data and disassembled data. 
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4.8.1 


Figure 4-4. 


Display 
Raw 
Trace 
DRT 


Trace Memory Format 


4.8.2 


Disassemble 
Trace 
DT 


DRT can be used to display Trace Memory data in bus cycles if you 
do not wish to use Disassembly to display instruction cycles. 


Invoking DRT causes the Satellite Emulator to display a page of bus 
cycles of the Trace Memory. More or less cycles may be displayed 
by specifying an address or address range in an argument following 
the operator. If a single address is specified, the system will 
display the specified address and the previous 20 bus cycles. The 
Trace memory holds 2,046 cycles; therefore, 2,046 is the highest 
number allowable as input. Note that the raw Trace Memory contains 
the 16—bit status and control word (described in Section 5.2.6). 


e To display the most current page of bus cycles: 
>DRT<returm 


@e To display a specific line number and the previous 20 cycles: 
>DRT<address><returm 


e To display a range of line numbers: 
>DRT<range><returm 


Note that the range is a range of bus cycles, not the address re- 
corded in the Trace Memory. 


#59 
ADDRESS 
881888 
881862 
881904 
821986 
821988 
O@2168A 
82188C 
882888 
882288 
891885 
89318198 
682882 
882282 
882883 
882263 
882804 
892204 
882085 
682295 
92886 


LSA - 8 
$121111111 
$11l111111 
11111111 
$11111111 
$1li11111 
B11111111 
11111111 
#11111111 
11111111 
$121111111 
11111111 
#111121111 
$11111111 
$1l1111111 
$11111111 
BiL1l111111 
$11111111 
$11111111 
11111111 
$l1111111 


vvvvvuvve 


a 
w 
w 
ee SE REN ee es 
SRR ERTERERRRRRRRKRRE 
DADNAAAAKRUMNWAHWNNFHNN Oi 


BPRS BR AE: 


This operator will cause the Trace Memory to be disassembled and 
output to the controlling port (computer or terminal). If no range 
argument is specified, the last instruction executed is disassem- 
bled. The output of the DT operator in this instance has its line 
feed suppressed. Thus, by repeating the operators Step and Disas- 
semble Trace, a continuous Disassembly is formed (>STP;DT<return>). 
Some information can”t be disassembled because of qualifiers such 
as TOT or TRC (within the Event Monitor System). 


e To disassemble the last instruction executed: 
>DT<return> 


e To disassemble a range: 
>DT<single value or range><returm 
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The single or range values are sequence numbers where @ is the num- 
ber for the most recent instruction. Entering a single value will 
disassemble that value and the previous page. A range disassembles 
that range of sequence numbers. 


e To initiate a continuous Disassembly: 
STP; DT<returm 


NOTE 


When using Display Register (DR) and Disassemble Trace 
(DT) on the same line, enter DT first, then DR, as shown 
in this example: 


RBV;WAI;DT;DR<cr> 
If you enter DR first, the DT command writes over the 
last line of the register display. 


4.8.3 Disassemble These two operators will scroll you through the disassembled Trace 
Previous and Memory a page at a time. This is shown in Figure 4-5. 
Following 
Trace 
DTB e To disassemble the previous page: 
DIF >DTB< return 
e To disassemble the following page: 
>DTF<returm 
>DTE . 
Sfan ADLR OFCODE MHESONIC OFERAND FIELDS BUS CYCLE DATA 
OG49 PSM £086 _80186_Test 
0042 1005 BS0F00 mov CX, O00F 
0048 1003 #8£0520 AoV $1,2000 
C066 1005 eBF0do22 nov D1-2200 
0065 1099 as movs WORD PTR 2QOOO>FFFO 2200<FFFO 
0044 100A ‘FIZ RKREFZ 
OC454 1002 As rows BYTE PTR 
ZOCZ>JE 2202<3E Z2O03>FF 22035FF 20046500 32204<0: 
2005>00 2205<00 2006>FF 2204<FF 2007>FF 2207<F! 
2008200 220800 2009700 2209<00 200A>FF 220AK<F!I 
2O0C>FF 2208<FF 2000700 220C<00 2000700 2200<c0: 
ZOCE>FF 220E<FF 200F>FS 220F<FS 2010700 2210<Cc 
OCO€2 1008 O28100FF aDD AX» WORD FIR CBX-100]£D013 21i21>FF 00 
Q0f9 101¢ 890209 mov Cx, 0002 ‘ 
0926 10:3 F2 REFNZ 
OG25 19:4 a7 CAFS WORO FTR Q2OLL>F F110 2211>FF 10 
0025 101% €11690240% RCL WOKO PTR Data_Word,05 24007A002 2400<004A 
0017 16:8 C€3409004 ENTER 0040-04 
Figure 4-5. L7FESO0COO FFFEDFFFF L?7FC<FFFF OFFFCOFFEFF 
Disassemble L7FACSFFFF FFFADFFFE L7F8<FFFF 17 F6<L7FE 
COOLS 101E E0ED LOOPNE SHORT FGA_2086_ 80186 Test 
Trace 
Format 


When the question mark appears on the screen, you should key in a 


question mark in return to find out the error message. 


Table 4-2 


lists the errors that may occur by code and their messages as dis- 
call Customer 


played on the CRT. 


Service for ES products. 


4. U4 
4724 


If you need additional help, 


4.9 THE MEMORY 
DISASSEMBLER 


4.9.1 Display 
Disassesbled 
Memory 
DIS 


Example 
Using DIS 


4.10 THE LINE 
ASSEMBLER 


4.10.1 Standard 
Mnemonics 


If you are operating the Satellite Emulator under host system con- 
trol, only two errors are likely to occur, assuming the host system 
software has been fully debugged: Error 6, a checksum error and 
Error 34, a read-after-write error. The host system can be set up 
to return a question mark to the emulator and use the error code 
number to consult its own table for further action. 


The memory disassembler allows you to dump the contents of memory 
and have it displayed or printed in an easy-to-read format similar 
to a program listing. 


NOTE : 


You should be familiar with 8086/80186 assembly language 
programming before reading this section. The informa- 
tion presented here is an overview, which will provide 
the necessary instructions when used in conjunction with 
Intel documentation. You should have the iAPX 86, 88, 
186 and 188 User”s Manual Programmer’s Reference. 


This operator will cause memory to be disassembled and output to 
the controlling port (computer or terminal). If no argument is 
specified, one page of disassembly is displayed, beginning at the 
last address when this operation was previously invoked. 


e To disassemble one page of memory beginning at the last address 


when this operation was previously invoked: 
>DIS<return> 


e To disassemble one page of memory beginning at the specified 
address: 
>DIS<single value><returm 


e To disassemble a range of memory: 
>DIS<range><returm 


e To continue disassembly one line at a time: 
><space> (at the end of each line) 


e To continue disassembly one page at a time: 
><returnm> (at the end of each page) 


The 8086/80186 Line Assembler allows you to enter and assemble 
Intel mnemonic instructions into target memory. In addition to in- 
structions, there are "Assembler Directives: to aid you in select- 
ing memory addresses, using symbols, inserting numbers and text 
strings into memory, etc. The Line Assembler gives you a powerful 
software tool to facilitate in software patching, hardware/software 
debug, developing small programs, writing hardware/software test 
routines, etc. 


All standard Intel 8086 and 80186 mnemonics are supported. These 
are listed in the ASM86 Language Reference Manual. 
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4.10.2 Assembler The following assembler directives are supported: 


Directives 
DIRECTIVE 


CSEG 


ORG 


L@,L1...L9 


“symbol 
<returm 


$ 
THIS NEAR 


THIS FAR 


DESCRIPTION 


Sets 64K byte code segment window (corre- 
sponds to CS register). 


Sets 64K byte offset into the code segment 
window. 


Exits Line Assembler to the command level. 
Defines byte data. 

Defines word data. 

Toggies preview display mode. 

Sets value for symbol (only valid with in- 
stalled symbolic debug hardware) or local 
symbol (L@—-L9). 


Print value of local symbol. 


Print value of symbol (only valid with 
installed symbolic debug hardware). 


Disassemble one instruction at current 
address. 


Current line assembly offset address. 
Current line assembly offset address. 


Current line assembly segment and offset 
address. 


The key sequences for these assembler directives are shown in 


example 5-6. 


NOTE: 


Lines shown in bold type with a <returm are user 
entries; lines shown in regular type are the assembled 


response. 

Example 

Use of Assembler 

Directives e To set Code Segment window (64K~byte assembly window): 


1912 >CSEG OD46@H<returm 


1912 > 


e To set line assembly origin within code segment window: 
1912 >ORG 38ACH<return> 


38AC > 


£- 
oO. 


e To exit line assembly: 
58FD >XK<returm 
*&*kkk END OF LINE ASSEMBLY **** 
> 


e To define constant byte data: 

. 58FD >DB 1,2,3,4, “TEST” ,é<returm 
58FD 61 62 03 64 54 45 53 54 GG 
5996 > 


e To define constant word data: 
(Note: odd length text strings are padded with nulls) 
58FD >DW 1,2,3,4,"TEST" ,§<returm 
58FD 6160 6200 6380 6460 4554 5453 GOGO 
59@B > 


@ To toggle to preview mode: 
6599 >PRE <return> 
659% C647$234 MOV BYTE PTR [BX+2H] ,34H 


e To toggle out of previous mode: 
6596 C647$234 MOV BYTE PTR [BX+2H],34H >PRE<return> 
6596 > 


e To define/redefine local symbol or symbolic (if symbolic debug 
hardware is installed)" 
659% >L3 EQU 7A44H<returm 
659 > 


or if symbolic debug hardware is installed: 


6596 > “Unit EQU $FDEOH<returm 
6596 > 


e To print local symbol: 
756A >L3<return> 
756A >L3 EQU 7A44H 
756A > 


e To print symbol (if symbolic debug hardware is installed): 
756A >“Unit <return> 
756A >“Unit EQU FDEOH 
756A > 


e To disassemble one instruction at current code segment and line 
assembly offset address: 
5DéA ><returm 
5D@A 33G6AD78 XOR AX,WORD PTR 78ADH 
5DOE > 


4.10.3 Usage Notes Plus, minus, asterisk, or slash are the only arithmetic operators 
+-—-%* / allowed in expressions. Note that only 16 bit arithmetic is 


performed. 


( ) Parenthesis are allowed to group expressions. 


4-27 


"-<bs> 


HOQTY 


4.10.4 Assemble 


Line To 
Memory 
ASM 
Example 
Use of ASM 


Double quotes (") or percent signs (%) are used to delimit ASCII 
strings. If you enclose the string in percent signs, you may not 
use percent signs within the string, but any number of double 
quotes may be used. If you enclose the string in double quotes, 
you may not use double quotes within the string, but any number of 
percent signs may be used. 


Upper-case strings are the default. The use of "“<backspace> will 
allow entry of lower-case letters within a text string until you 
enter a <space>. 


The number base used in the line assembler is the default base used 
by the system, except when the base is explicitly specified (H, 0, 
O05 Ty. Or): 


~ Hexidecimal 
- Octal 

Nak al 

VUClaL 

- Decimal 


- Binary 


MmeHO On 
t 


Example operand addressing modes: 


PASH Immediate addressing mode 

WORD PTR 5634H Direct addressing mode 

BYTE PTR 9DC4H Direct addressing mode 

[st] Indexed addressing mode 

[BX] [SI] : Base indexed addressing mode 

[ BX+STI] Base indexed addressing mode 

{ BX+5 ] Base Displacement addressing mode 
[ BP+4 ] Stack indexed addressing mode 
{BX+DI+15] Base displacement indexed 
[-3*(23+4 )+BX+ST ] Base displacement indexed 


This operator will cause the line assembler to be invoked. The key 
sequence is shown in the following example. If no argument is 
specified, line assembly will begin at the last address, when this 
operation was previously invoked. To exit line assembly and return 
to the command level, enter eiher END or X with the addressed 
prompt displayed (as shown here). 


e To start line assembly beginning at the last code segment and 
line assembly address when this operation was previously invoked: 


>ASM return 
*kEK 8986/88/186/188 LINE ASSEMBLER VX.XLA **** 


$000 > 


e To start line assembly beginning at the specified code segment 
and line assembly offset address: 


>ASM $C6A3<returm 
kkk 8986/88/186/188 LINE ASSEMBLER VX.XLA **** 


f 
j 
i) 
foe) 


Example 
Using Addresses 


Example 
Using Local Symbols 


e To 


terminate line assembly: 


9876 >X<returm 
*kkkX END OF LINE ASSEMBLY **** 


> 


The following examples represent ways in which the line assembler 
can be used. 


> ASM 
KKK 


$166 
$169 
6186 
$163 
$105 
$165 
$166 
$186 
$168 


KKK 


> ASM 
KKKK 


5186 
$106 
6166 
$103 
$193 
$165 
6196 
0166 
$148 


RREK 


19¢<returnm 
8086/88/186/188 LINE ASSEMBLER VX.XLA **** 


>CSEG 5$6¢<return> 
>MOV DX,8<returm> 
BAG8GG MOV DX,8 
8969 MOV WORD PTR [BX+DI],CX 
>DEC DX<return> 
4A DEC DX 
>JNE WORD PTR 163<returm 
75FB JNE WORD PTR 163 
>X<returnm 
END OF LINE ASSEMBLY **** 


19@<return> 
8986/88/186/188 LINE ASSEMBLER VX.XLA **** 


>CSEG 5$$6<returm 

>MOV DX,8<returm 

BAG8GG MOV DX,8 

>L5 MOV WORD PTR [BX+DI] ,CX<returm 
89¢9 L5 MOV WORD PTR [BX+DI],CK 
>DEC Dx<returnm> 

>JNE WORD PTR L5<returm 

75FB JNE WORD PTR L5 
>X<returm 

END OF LINE ASSEMBLY **** 
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Example 
Using Assembler 
Directives >ASMreturm 
*kkk 8986/88/186/188 LINE ASSEMBLER VX.XLA **** 


0168 >ORG $+196¢<return> 

1198 >CSEG<returm 

11G8 >CSEG 5460 

1168 >L2 EQU 4<returm 

1168 >L3 EQU L5-$+2<returm> 

1168 >L1 DB "TEST" ,@<returm 

1198 54 45 53 54 @@ 

116D >ORG 266@<returm 

2600 >MOV SL, WORD PTR Lil<return> 
2666 8B36¢811 MOV SI, WORD PTR Ll 
2004 >MOV DI,WORD PTR L3<returm 
2064 8B3EFCEF MOV DI,WORD PTR L3 
2008 >MOV CxX,4<returm 

2048 899466 MOV CX,4 

20468 >REP<returnm 


2068 F2 
2669 >MOV SB 
2009 A4 MOV SB 


26GA >X<returm 
**k* END OF LINE ASSEMBLY **** 


> 
Example 
Error Message 
In Response To ? > ASMreturn> 
*kk* 8986/88/186/188 LINE ASSEMBLER VX.XLA **** 
20¢D >“label JNZ WORD PTR 1634 <returm> 
? 
>? 
ERROR #9 
ARGUMENT OUT OF RANGE 
Example 
Using Symbols With 
Symbolic Debug >ASM <returnm> 


Hardware Installed %**** 8$86/88/186/188 LINE ASSEMBLER VX.XLA **** 


20@D >JZ $+6<returm 


206D 7404 JZ $+6 
2GGF >JMP WORD PTR 1934<returm 
20GF FF26341@0 JMP WORD PTR 1634 


2013 >“label EQU 4666<returm 

2913 >“page_table EQU 1899¢<return> 
2613 >“pt_blink EQU 4<returm 

2413 >MOV BX,“ page_table<returm 

2013 BB9G18 MOV BX,page table 

2616 >LEA BX,[BX+~pt_blink ] <returm 
2616 8D5FG4 LEA BX,[BX+*pt_blink ] 
2019 >X<returm 

xkkK END OF LINE ASSEMBLY **** 


{~ 
t 
Go 
© 


4.11 STATEMENT CONTROL You can save time and effort by using less keystrokes when you uti- 


4.11.1 Repeat 
Command 


Indefinite 
Repeat 


lize the Repeat and Macro functions. Your individual need for 
these capabilities will appear as you identify sequences of com- 
mands that you use repeatedly. 


e The Repeat command repeats one or more commands a specified 
~ number of times or indefinitely. 


e The Macro capability allows you to define and save up to ten 
macros, calling them out as necessary. 


An asterisk (*) at the beginning of a command line repeats one or 
more commands. (The asterisk must be the first character of the 
input line.) If the asterisk is followed by an optional decimal 
argument, you can specify the number of times to repeat the buffer 
contents. A command having normal syntax succeeds this argument. 
If the argument is zero, the buffer content is not executed. 


e The repeat argument must be specified in decimal and cannot be a 
variable 


e There must be a space following the repeat argument if the first 
character in the macro is a decimal digit 


For example: 
>*5STP; DT 
>* 5STP;DT 
>* 5 STP;DT 


In each of these three examples, the "STP;DT" command is repeated 
five times. Note that if the slash key is typed after the above 
example is input, the entire line is repeated, causing five more 
"STP;DT'" commands to be executed. 


When the repeat, argument is not specified, it is assumed to be 
4,294,967,295 (2°°“-l). There are two ways to stop an indefinite 
repeat. 


First, you can abort a repeat by executing a reset (usually a CNTL 
Z).« However, note that this will also abort emulation if it is in 
progress without saving the state of the CPU. 


Second, there is a variable called "TST" that gets set to all l’s 
at the beginning of a repeat. Then it is tested for zero just 
before a line is re-executed. If TST becomes zero, the buffer is 
not executed and the repeat halts, returning control to the users 
terminal. 


If you want to single step and disassemble until you reach a 
particular address, you could type, for example: 


>*STP; DT; TST = IP-$C324 


4-31 


4.11.2 Loop Counter 


4.11.3 Macros 
Defining 
Macros 


In this example, single stepping continues until the instruction 
pointer equals 0C324 Hex. If the IP does not reach 0C234, you can 
still use CNTL Z to stop the repeat. 


When a repeat is initialized, just before execution begins, the 
value of the repeat argument is assigned to a variable called 
"LIM:" another variable called "IDX" is reset to zero. After each 
execution "IDX" is incremented and then compared to "LIM;" if 


"Ipx" is greater than or equal to "LIM" the repeat is stopped. 


Since "LIM" and “IDX" are variables, they may be used in commands 
or modified by the execution of the repeat. 


Here are three examples: 


>BASE IDX=#10 
>*3 IDX 

#0 

#1 

#2 


>M $1000 

$001000 $34 >*4 LIM-IDX-1 
$001001 $CO 

$001002 SBF 

$001003 $00 


$001004 $21 >M MMP-4 
$001000 $03 >*4 
$001001 $02 

$001002 $01 

$001003 $00 

$001004 $21 > 


In the first example, "IDX" is printed showing that it is reset to 
zero and incremented thereafter. The second example shows how a 
block of memory can be initialized to a decrementing count ending 
in zero. In the last repeat example, the initialized block of 
memory is displayed. 


If "IDX" is modified during a command repeat loop, it will still be 
incremented before being compared to "LIM." This may cause the 
loop to be exited one cycle earlier than expected. 


- You can define up to ten macros. They are referred to by decimal 


numbers 0-9. The ten macros are stored in one buffer with #1 be- 
ginning first then #2...#9 with #0 being last. 


If the sum of the lengths of all ten macros is greater than the 
buffer Length, then macros will be truncated in this order: 0, 9, 
8, 7, 6, 5, 4, 3, 2, 1. (This truncation happens silently, without 
any indication to you.) 


Here are some macro definition examples: 


>_1=STP;DT 
>_2=GD1=GD1+1 
> 3= 13 2 


Filling 
The Buffer 


Displaying 
Macros 


The syntax is as follows: 


e the first character on the line must be the underscore 

e the second character must be a decimal digit, a comma, or a 
period 

e the third character on the line must be an equal sign 


If the syntax is not correct, the line will be passed to the par- 
ser, which will throw it out as illegal syntax. If the syntax is 
correct, the remainder of the line after the equals and up to, but 
not including the return, will replace the previous definition of 
the macro. No syntax checking is done when a macro is defined, 
syntax errors will only be detected when the macro is executed. 


In the above example, macro #3 contains two nested macros. The 
macros are not expanded when the macro is defined, but only when it 
is executed, so the definition of macro #3 may change depending on 
the content of macros #1 and #2. 


If macros #1 to #8 are defined, and in this process used up all of 

the space in the buffer, then an attempt to define macro #9 or #0 
would result in those macros remaining null. Also, if the length 
of any macro from #1 to #7 was increased after filling the buffer, 
then macro #8 would be truncated as a result and if the increase 
was more than the size of macro #8, then macro #8 would become null 
and macro #7 would be truncated, and so on. There are no warnings 
when truncation or nullification takes place, so if a number of 
long macros are defined, the 'MAC' command should be executed to 
determine if the macros with the highest numbers are still intact. 


The MAC command will display all of the macros that contain one or 
more characters. Nested macros are not expanded by MAC. The 
macros are displayed the way you typed them in and they are 
identified by the same three character sequences that are used to 
define the macros. 


This is an example of macro definition: 


>_5="This “is “a “macro 
> 6=ABCDEFG 
> 1=PCO;RET;STP;DT 

oe 2=PCO=$ 1000 
>| 3 
>!  4=@ 
>| 6 


M $2000+GD0 
@(RR14+4) 


This is an example of macro display: 


>MAC 
_1=PCO;RET; STP; DT 
_2=PCO0=S 1000 

3=M $2000+GD0 
_4=@(RR14+4) 
_5="This “is “a “macro 
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Executing 
Macros 


Saving 
Macros 


You can execute macros #1 and #2 by a single keystroke when not in 
memory mode. Whenever you type a comma as the first character on a 
line, macro #1 is executed; if you type a period as the first char- 
acter on a line, macro #2 is executed. You can execute any of the 
ten macros by entering the underscore followed by a decimal number. 


A macro may contain a portion of a command, or an entire command. 
It cannot contain part of a token, i.e., the "RO" register cannot 
be specified by taking the last character of one macro ("R") and 
concatenating it with the first character of the next macro ("0"). 
If several macros each contain a single command, and you want to 
execute them serially as a string of commands, use the semicolon to 
separate the macro calls. For example: 


Pm Ay 253 


The semicolon can also be used within the macro at the beginning or 
end to separate commands. for exampie: 


_1=STP;DT; 
~2=DR 


(This is called out by 1 2) 


Since a macro may contain a portion of a command, you could do 
something like the following example: 


Macro definition: 


>_4=GD1 
>_5==$24 
> 6==@4 
Macro execution: 
>_4 6 >GD1=@4 
> 45 >GD1=$24 


The right side shows how the macro is expanded when executed, the 
contents of the two macros are concatenated to form a complete 
command. 


To load and save macros, enter the following: 


>LD 5<return> 
>SAV 5S<returnm 


Please see the LD/SAV section, 3.7.2, for information about ini- 
tializing the EEPROM. 


Clearing If you define a macro but only type a <return> following the equal 
Macros sign, the macro is defined as null. A null macro is not displayed 
by the MAC command and when it is executed, no characters replace 
the macro call argument. 
To nullify a specific macro, enter: 
—n=<returm> 


To nullify all macros, enter: 


>CMC<return> 
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SECTION 5 
PROGRAMMING THE 
EVENT MONITOR SYSTEM 


5-1 INTRODUCTION 


5.2 DISPLAYING AND CLEARING THE EVENT MONITOR SYSTEM 


5.3 EVENT COMPARATORS 

3.1 Address Comparators 
3.2 Count Limit 

3.3 Data Comparators 
3.4 Status Comparators 
3.5 Dont Cares 


5.4 EVENT MONITOR SYSTEM ACTIONS 
5.4.1 Force Special Interrupt 


5.5 EVENT GROUPS 
5-6 OPTIONAL LOGIC STATE ANALYZER 


5.6.1 LSA Functions 
5.6.2 Timing Strobe 


Sel 


INTRODUCTION 


The Event Monitor System is an expanded and enhanced breakpoint 
system. It is used to detect specific events occurring in the tar- 
get system and to perform actions when these events are detected. 
Action is taken according to a set of statements. These statements 
combine detection comparators and action items. When an event is 
detected, any of the following actions may occur: 


all-cycle trace 

single-cycle trace 

window-mode trace 

external triggering 

pass counting 

breakpoints (ranging from simple to highly complex) 


In addition, the Logic State Analyzer option gives you access to 
sixteen external logic signals that can be user-defined and con- 


‘sidered in the Event Monitor System. 


To set up the Event Monitor System, you must define event detectors 
that will trigger an action list. The event detectors and the 
action list are combined into WHEN/THEN statements, which become 
active when running the target system. WHEN/THEN statements take 
the following form: 


WHE[N] <eveat> THE[N] <actiom 


Event detectors may be combined using AND, OR, and NOT. These are 
like logical ANDs, ORs, and NOTs, except that they are not on a bit 
level. A more complex example of a WHEN/THEN statement might look 
like this: 


e WHE[N] <event> AND <event> OR <event> THE[N] <actiom, <actiom, 
<actiom 


There are four event groups, each group consisting of eight compar- 
ators. The system can operate in only one group at a time. Each 
WHEN/THEN statement must be defined for a specific group. If no 
group is defined, the statement will default to group 1. WHEN/THEN 
statements are used to link event groups together for sequential 
operation. 


Remember that the Event Monitor System must be set up prior to its 
use. Comparator values and WHEN/THEN statements can be stored in 
the EEPROM between emulation sessions. (Two users may store their 
event system setups.) 


NOTE 


When the Event Monitor System is used in 
conjunction with emulation, timing is not 
affected - the emulator still operates in 
real time. 


The table on the next page summarizes the operators used with the 
Event Monitor System. (These operators are also displayed online 
on page 2 of the Help Menu.) 


Table 5-1 ° 


Event Monitor OPERATOR NAME BITS 
System WIDE 
SETTING AND C1EARING CES clear event system 
DES display event system 
-EVENT COMPARATORS ACl address comparator 1 24% 
(singly or in combinations AC2 address comparator 2 24* 
comprise event detectors) DCl data comparator 1 16** 
DC2 data comparator 2 16** 
Sl status comparator l 16** 
$2 Status comparator 2 16** 
LSA Logic State Analyzer 
comparator 16** 
CTL count limit comparator 16 


*single address or address range 
*kincludes Dont Cares 


ACTIONS CNT count event 
(What the Satellite FSI Force Special Interrupt 
Emulator does in response BRK break emulation during RBK or RBV 
to the event detectors; TGR trigger signal high for one 
several actions may bus cycle 
be combined in a single TRC trace event 
statement) RCT reset count limit 
GRO switch event group 
TOT toggle tracing 
TOC toggle counting 
STATEMENT OPERATORS IRA internal range 
(used to combine event XRA external range 
comparators and actions TO to 
into statements) LEN length 


WHEN when 
THEN then 


AND and 
OR or 
’ NOT not 
DC Don’t Care 
SIA Special Interrupt Address 
5.2 DISPLAYING Two operators are included for clearing the contents of the Event 

AND CLEARING Monitor System and displaying its contents. 
THE EVENT 
MONITOR e To clear all the WHEN/THEN statements: 
SYSTEM >CES<returnm> 
DES 
CES e To clear the WHEN/THEN statements for a single group: 


>CES <group number><returm 


e To display all of the WHEN/THEN statements: 
>DES<return> 


e To display the comparators as well as the WHEN/THEN statements 
for a given event group: 
>DES <group number><returm 


523 EVENT 
COMPARATORS 
Dede l Address 
Comparators 
AC1l 
AC2 


There are eight event comparators for each of the four event system 
groups: 


COMPARATOR TYPE (AMOUNT) DATA TYPE 
Address (2) Integer, Internal Range 


External Range 


Data (2) Integer, Don“t Care 
Status (2) Integer, Don“t Care 
Count Limit (1) Integer 

Logic State Analyzer (1) Integer, Dont Care 


Values contained in any other register in the system may be 
assigned to the comparators, as long as the data types are com- 
patible, for example: 


The ES Event Detectors can be set up to resolve these three condi- 
tions. Assume the byte in question is at $04001. This byte could 
be accessed by the address $04001 or $04000. If the address $04001 
is on the bus, then the byte is accessed. If the address $04000 is 
on the bus, and the bus cycle is a 16-bit cycle, then the byte is 
accessed. If the address $04000 is on the bus, and the bus cycle 
is an 8-bit cycle, then the byte is not accessed. The following 
setup will handle this condition; 


AC1 = $04000 
AC2 = $04001 
Sl = WRD 


WHEN AC1 AND Sl OR AC2 THEN BRK 


AC1 contains the even address. Sl is the word bus cycle condition. 
If both are true, the high or odd byte has been accessed. AC2 con- 
tains the actual odd address. If it is true, then the byte is 
always being accessed. If either is true (or), then the byte is 
being accessed. If neither is true, then the byte is not being 
accessed. 


The address comparators match addresses occurring within the emula- 
tion process against the 24-bit address bus. If a match is detect- 
ed, the associated action occurs. 


Address comparators can be a single address, an internal range, or 
an external range. 


The examples shown here illustrate the format for assigning address 
comparators and ranges. When a single address is assigned to an 
address comparator, such as ACl = $4766<returnm>, each time the 
address $4766 appears on the address bus, the ACi comparator will 
detect this "event" and will produce a true output (the action 
associated with the AC] event detector). 
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IRA 


LEN 


NOTE 


ODD BOUNDARIES 


The address comparators in the 80186 may need to be specially set 
up because it is a 16-bit machine with a prefetch QUE and byte 


-based instructions. This leads to problems with breaking on in- 


structions that occur on odd boundries. When the 80186 prefetches 
the instruction, it outputs the even address. Both bytes are 
fetched, and the actual (odd) address of the byte in question is 
never seen. The traditional idea of setting the Event Detector to 
the odd address will obviously not work. If the 80186 jumps to the 
odd address, the odd address does appear on the bus, and that byte 
alone is fetched. In this case, the traditional sense of setting 
up the Event Detector does work. The final case is when the low 
byte only is read. In this case, the even address appears on the 
bus, but the odd byte is not read. 


e To set an address comparator to a single address: 
>AC1.3 = $06FF<returm 
or 
>AC2.1 = $3488<returm 
or 
>AC] = IP + $200 <returm 


The assignment statement may include other operations, such as add- 
ing an offset to one of the CPU registers (in this example the in- 
struction pointer). This would cause the specified event to occur 
upon an access $200 bytes ahead of the current instruction pointer. 


e Ranges are set up with the IRA, XRA, TO, and LEN operators. To 
set an address comparator to an internal range (all addresses 
from n to m, including addresses n and m): 


address comparator = IRA <address m> TO <address m<returm 
>AC2 = IRA $3000 TO $3FFF<returm 
or 
address comparator = <address> LEN <length><returm 
>AC2 = $3000 LEN $1000<returnm> 
or 
address comparator = <address n> TO <address m<returm 
>AC2 = $3000 TO $47FF<returm 


Note that when no prefix is applied (IRA or XRA) the range is 
assumed to be internal--IRA is implied. 


e To set an address comparator to an external range (all addresses 
not between n and m -- addresses lower than and including n, or 
addresses higher than and including m): 


address comparator = XRA <address n> TO <address m><returm 
>AC] = XRA $2000 TO $32FB <returm 
or 
>AC] = XRA $2000 LEN $32FA <returm 
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5.323 


(!) 


Count Limit 
CTL 


Data 
Comparators 


DCl 
DC2 


e The inverse operator (!) can also be used: 
>AC2 = IACI 


The above would define AC2 as the inverse of ACl. If ACl is 
_ internal, AC2 would become its complementary external range and 
vice versa. 


Both internal and external ranges include endpoints as part of the 
valid range. The LEN Operator provides an alternative to specify- 
ing ranges. When a range is specified with a LEN expression, the 
first value specified is the beginning address of the range and the 
last value is the block size (the length specified with LEN, minus 
one). Ranges can also be defined from other ranges with the in- 
verse operator (!) shown in the first example. 


NOTE 


Addresses can also be assigned with the indirection 
operator (@). See section 3.6 for an example. 


Each event group has a count limit comparator, and the system has 
one hardware counter. When entering RUN mode, the value from CTL.1l 
is automatically loaded into the hardware counter, and may be used 
in event system WHEN/THEN statements, as shown here: 


S1 = RD + OVL 

CTL = #200 

WHE[N] Sl THE[N] CNT 
WHE[N] CTL THE[N] BRK 


In order to load the value from another CTL register into the hard- 
ware counter, a RCT (reset count) action must be specified in 
conjunction with the switch to a new group. This new count limit 
value may then be used in WHEN/THEN statements, as shown here: 


ACI = $7800 

CTL.2 = #10 

AC1.2 = $7840 

WHE[N] ACI THE[N] RCT, GRO 2 
2 WHE AC1 THE[N] CNT 

2 WHE[N] CTL THE[N] BRK 


Event groups are discussed in more detail in Section 5.5. 


The data comparators are set like the address comparators. Data 
comparators may be assigned integer values and may contain Dont 
Care bits (see Section 5.3.5 for a detailed explanation of Don’t 
Cares). Other registers, such as general purpose registers GDO-7 
may be assigned to these comparators. 


e To assign an integer 
DC1 = $F033 
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5.3.4 Status 


Comparators 


Sl 
$2 


Table 5-l. 
Status Mnemonics 


o To assign a Don’t Care value 
DC2.3 = $FFOO DC S$FF 


GDO (general purpose data register) 


The Satellite Emulator records a 16-bit status and control word in 


every Trace Memory cell. The bits in this word are a combination 


of 80186/80188-generated signals and signals internal to the 
emulator. 


The emulator has a set of "constant" registers that the Event 
Monitor System can use as event comparators. When the status word 
matches the status defined by Sl and/or S2, the comparator output 
is true. 


The following table lists the status constants. Example 5-2 shows 


how to set Sl and S2. 
NOTE 


Do not set Sl or S2 to break on a type 2 interrupt. 
This includes an NMI. You should set up the system to 
break on the vector fetch or the starting address of 
your interrupt routine or the emulator will not work 


correctly. 

MNEMONIC DESCRIPTION 

BYT Byte Access 

HLT Halt Status 

TAK Interrupt Acknowledge 
IF Instruction Fetch 
IOA IO Access 

MEM Memory Access 

NBC No Bus Cycle 

NMI NMI Cycle 

OVL Overlay Access 
QD1-6 Que Depth (1-6) 

QF Que Flush Cycle 

RD Read 

RIO Read IO Status 

RM Read Memory Status 
TAR Target Access 

WIO Write IO Status 

WM Write Memory Status 
WR Write 

WRD Word Access 

DMA DMA Cycle 


Example 5-1. 
Setting Status 
Comparator 


Example 5-2. 
Examining the 
Contents of the 
Status Comparator 


Activated 
Bit Values 


2 


an 

SB 

tow 
Whore © 


*NOTE: 


i 


l 
X87 aK oR AR/ 7 
NMI DMA OF |I0A /OVL 


1 2 3 4 5 6 7 8 
Sl = TAR + RD + BYT + MEM + HLT + QDI + OF 
$2 OVL WR WRD LOA LAK QD2 NMI 

NBC QD3 DMA 
RIO QD4 

RM QD5 

WO QD6 

WM 

IF 


Note the eight-column format. A status comparator may be set with 
a maximum of one constant from each of columns 2-7; and as many as 
you want from column 8. 


Remember that these are maximums. 
the possible constants. 


It is not necessary to use all 


e Some sample status comparators are: 


>S1 = TAR + RD + IF + QF 
>S2 = IOA + WR + DMA 
>S2 = OVL + RIO 


The addition sign is used as a connective between the constartt 
mnemonics acting as a Boolean "AND." 


To examine the contents of the status comparator, type Sl or S2. 
Note, however, that when the status comparator name is keyed in, 
the system responds with a value, rather than the mnemonic code 
used to enter that value into the system. The table below is used 
to translate the system response back into the mnemonic codes 
entered originally. 


BYT 
WRD 


= 0 ODL] 2 IOA + OVL + WR + ae i) 

a =] QD2 = 4 BYT = 1 
WIO = 2 QD3 = 6 RD = 2 
HLT = 3 QD4 = 8 RD + BYT = 3 
IF =4 QD5 =A TAR = 4 
RM 5 QD6 = C TAR + BYT = 5 
WM 6 TAR + RD = 6 
NBC = 7 TAR + RD + BYT = 7 
MEM = 8 

MEM + BYT = 9 

MEM + RD =A 

MEM + RD + BYT = B 

MEM + TAR = C 

MEM + TAR + BYT = D 

MEM + TAR + RD = E 

MEM + TAR + RD + BYT = F 


The ALT, STA, COD and DAT statuses are used by 8086/8088 emulators only. 
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When you type Sl or S82, the system responds with a value with this 
general format: 


$ 0000x,X,X,x) DC 0000X,X,X,X, 

The hexadecimal values X,, Xo» ; xy, represent the bit 
patterns of the status comparator registet. Those to the left 
of the DC operator correspond to the activated bits (0s); 
those to the right are the Don’t Cares, or mask values (ls). 


Examination of the mask values reveals which bits have been 
activated, or enabled. A mask of FFFF shows that all the bits 
are masked, while a mask of FF8F indicates that all bits 
except 4, 5, and 6 have been masked. That is, 4, 5, and 6 are 
the only bits that have been enabled. 


The activated bit values, to the left of the DC operator, 
correspond to the mnemonic entered into the comparator. These 
mnemonic codes can be read directly off the table once the enabled 
bit pattern has been determined. For example, suppose the system 
responds with: 


a) $ 000000100 DC OOOOFS8FF 
The mask value shows that bits 8, 9, and 10 have been enabled. 
The 1 in the X, column to the left of the DC operator can be 


matched with the 1 in the same column of the table, indicating 
that the mnemonic entered was RIO. 


b) $ 00000100 DC OOOOF8FB 

Mask values: all except 2, 8, 9, and 10 are masked 

Mnemonic values: the 1 in X, corresponds to RIO. The O in 
column X, corresponds to some combination of IOA OVL, WR, and 
WRD; since only bit 2 is activated, though, the mnemonic 
entered must have been OVL. 

Original entry: Sl = RIO + OVL 

c) $ 00000454 DC OOOOBSFB 

Mask values: all bits except 2, 8, 9, 10, and 14 are masked. 
Mnemonic values: since bit 14 is activated and a 4 shows in X 


NMI must have been entered; the 5 in X, corresponds to RM, aa 
the 4 in xX, matches with TAR. 
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Don’t Cares 
DC 
x 


Original entry: Sl = NMI + RM + TAR 
d) $ 00000009 DC OOOOFFE4 
Mask values: all except 0, 1, 3, and 4 are masked. 


Mnemonic values: the 0 in X, corresponds to QF in the table; 
the 9 in X, indicates that bifs 0, 1 & 3 are activated. 


Original entry: S1=QF + MEM + WR + BYT 
e) $ 00001000 DC O00068FF 
Mask values: bits 8, 9, 10, 12, 13 and 15 are enabled. 


Mnemonic values: bit 14 is masked so X4 is used to indicate 
which segment register was used to form the address during 
this bus cycle. Since bit 12 is set, the chosen segment is 
STA. Bit 11 of X, is masked which selects the processor 
status and since X, is zero, IAK is the activated status. 


Original Entry: Sl = STA + IAK 


The DC or X operators specify Don’t Care bits. Bits specified to 


the left are significant while those to the right are ignored 
(Don”t Cares). Where overlap occurs between significant and Don“t 
Care bit positions, the bits are treated as Dont Cares. 


Don’t Cares are used with the event detectors when it is desirable 
to restrict monitoring to a subset of the sixteen data, status, and 
LSA lines; for example, you may wish to monitor only the low-order 
eight bits and ignore the high-order bits. This is done by 
specifying the high-order bits as Don’t Cares. 


Address comparators and count limit comparators may not contain 
Don’t Cares. 


e Don’t Cares can be assigned in data, status, or LSA comparators. 
An example of setting a data comparator and including a Dont 
Care is: 


>DC1 = $0055 DC $FFOO0<return> 


The value of the Don’t Care expression is assigned to DCl. The 
first value in the statement ($0055) is the match value. The 
comparator will be looking for this value on the data bus. The 
second value ($FFO0) is the Don’t Care mask. The comparator will 
mask all bit positions containing ones. 


5-10 


5-4 


EVENT MONITOR 
SYSTEM ACTIONS 


e Another method of entering Don“t Cares and defining comparators 
uses Xs to mark the Don’t Cares: 


>DC1 = $4xxX2<returm 


- ‘The result of this assignment is S4FF2 as significant and SOFFO 
as Don’t Cares. 


e A sample LSA comparator would be: 


>LSA = #65532 DC 210 


Note that the Don’t Care value can be specified in different 
bases. The emulator looks at #65532 and translates it, then at 
410 and translates it before dealing with the value as a whole. 


The event detectors cause the Satellite Emulator to perform an ac- 
tion when they are detected during emulation. The trace function 
defaults to the ON state--tracing all bus cycles-~unless TRC or TOT 
is specified. 


The most commonly used detectors are BREAK, TRACE, and COUNT. 
e BRK (Break) causes emulation to halt. 


e TRC (Trace) traces the event; the Trace Memory is ON unless TRC 
or TOT is specified. 


e CNT (Count) decrements the pass counter on the occurence of a 
specified event. RCT resets this counter. 


e TOT (Toggle Trace) allows windowing. By identifying a starting 
event and ending event you can toggle the trace from ON to OFF or 
OFF to ON. 


e TOC (Toggle Count) allows you to window the pass counter. By 
identifying a starting and ending event, you can toggle the 
counter from ON to OFF or from OFF to ON. 


e RCT (Reset Counter) resets the pass counter to the specified 
count. To load the counter, see Section 5.3.2, Count Limit. 


e TGR (trigger) causes the trigger output on the LSA Pod Assembly 
and BNC connector to be high for the next cycle. (LSA is 
discussed in detail in the next section. For BNC trigger 
information, see the Timing Strobe, Section 5.6.2.) 


e GRO (Group) causes the system to switch to another event group. 
(Event groups are discussed in more detail in Section 5.5) 


The order in which actions are specified in a WHEN/THEN statement 
is not critical except in two cases: 


e Lf CNT and RCT are both specified for the same event, the 
resulting action is RCT. 


e If both CNT and TOC are specified for one event, the second 
action specified will be performed. 


To perform both TRC and TOT or CNT and TOT functions, each function 
should be in a separate group. 


Example 5-3. Breakpoints range from very simple to highly complex. A simple 

Types of Breakpoints breakpoint would be to break emulation when a particular address in 
the target program is accessed. For example, you could instruct 
the emulator to wait for the CPU to access a particular instruction 
in a program and to break emulation when the access occurs, as 
shown here. This type of breakpoint is useful for running the 
program until it reaches the code module or subroutine that you 
want to debug. 


e To halt emulation when address = $3000 
>WHE[N] ACL THE[N] BRK 
>AC1 = $3000 


After setting this and using RBK (run with breakpoints), the 
program will execute until an access of any kind occurs at 
address $3000. 


Each of the following examples adds a new feature or level of 
complexity to the WHEN/THEN statements shown here. Remember that 
the Event Monitor System can be used for many possible combinations 
of events and actions to suit your own needs. These examples 


illustrate only a small percentage of the possibilities the system 
is capable of. 


e To halt at a code module with multiple entry points 
>WHE[N] AC1 THE[{N] BRK 
>AC1 = $3000 TO $32FC 


The same WHEN/THEN statement is used, but ACI is now defined as a 
range 


e To save only the bus cycles you want to view 
>WHE[N] AC1 THE[N] TRC 
>AC1 $3000 TO $32FC 


In this case, you do not have to specify a breakpoint; only the 
bus cycles occuring in the range AC] will be traced. 
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5.4.1 


Force 
Special 
Interrupt 
FSI 

SIA 


e To use the pass counter 
>WHE[N] AC1 THE[N] TRC, CNT 
>WHE[N] CTL THE[N] BRK 
>AC1] = $3000 TO $32FC 
>CTL = SA 


In this example, each bus cycle occurring in the address range 


$3000 to $32FC will be stored in trace memory and cause the pass 


counter to be decremented. When ten cycles (0A, ) have occurred, 
emulation will be broken. 


e To stop program execution when a specific data pattern is written 
to memory at a certain address 
>WHE[N] AC1 AND DCl AND Sl THE[N] BRK 


>AC1 = $3000 (address comparator) 
>DC1 = $55AA (data comparator) 
>S1 = WR (status comparator set to write) 


When conditions ACl, DCl and Sl are met simultaneously, the 
emulator will break. 


e To stop program execution when one pattern appears at either of 
two addresses during a write cycle 


>WHE[N] AC1 AND DCl AND SI OR AC2 AND DCI AND SI THE[N] BRK 
e To set two conditions for a breakpoint 


>WHE[N] AC1 AND DC1 AND Sl THE[N] BRK 
>WHE[N] AC2 AND DC2 AND S1 THE[N] BRK 


In some of the examples shown ACI was used; however, AC2 could also 
have been used. 


The Force Special Interrupt feature allows your program to jump to 
any address (for instance, a particular subroutine) when a speci- 
fied event is detected. This address is set by assigning a value 
to Special Interrupt Address (SIA). 


The user program is interrupted by the Event Monitor System when 
the FSI event is detected, and program execution will begin at the 
SIA. The routine must terminate with an "Interrupt Return" (IRET) 
instruction to properly return to the interrupted routine. The 
message FSI ACTIVE will be printed when an FSI occurs. 


NOTE 


When using the Event System FSI action, some internal 
cycles are traced immediately preceeding the jump to the 
SIA. This occurs because the cycles are not purged from 
trace. If they were purged, the FSIs would occur more 
slowly which is undesirable, and the disassembler would 
not be able to disassemble the code. 


The FSI feature is helpful for inserting a quick patch in ROM code 
or to terminate a process requiring a careful termination routine. 
Only one SIA address can be set at a time. 


The keystroke sequence for setting and clearing the Force Special 
Interrupt is shown in the next example. The address argument is 
the address of the interrupt service routine. 


e To set the Force Special Interrupt address: 
>SIA = <address><return> 


e To force a special interrupt 
(A sample use for this would be to insert a code module that you 
did not include in a linked program that is already compiled and 


loaded for debugging.) 


>WHEN ACI THEN FSI 
>WHEN AC2 THEN FSI 


>SIA = $F2D0 
>AC1 = $302C 
>AC2 = $4010 


In this example, the program will execute normally until address 
$302C or $4010 is reached. When one of these addresses occurs, 
emulation will be halted. Address $302C (or $4012) will be pushed 
onto the CPU stack as the return address. The program counter will 
be set to the value specified in SIA ($F2D0), and the CPU will 
begin executing the program at the new address. To return to the 
original program at the end of the patch, execute an "Interrupt 
Return" (IRET) instruction (this will vary from processor to 
processor) and the CPU will unstack the pushed program counter 
($302E or $4012 in this example) and continue running from where it 
left off. 


FSI is not enabled during single step. 


5-5 EVENT GROUPS 
GRO 


Example 5-4. 
Sample Valid WHEN/ 
THEN Statements 


The Satellite Emulator is capable of having up to four groups of 
event detectors defined at one time, analogous to "event states." 
This is done by adding the suffix .n (n = 1 through 4) to the event 
comparators; for example, ACl can be AC1.1, AC1.2, DC2 can be 
DC2.4, etc. These groups are defined by placing a number preceding 
the WHEN/THEN statement or by appending a group number to the event 
detectors. The following examples would both define an event for 
Group 2: 


2 WHE[N] Sl AND LSA THE[N] BRK 
WHE[N] S1.2 AND LSA.2 THE[N] BRK 


Within one WHEN/THEN statement, only one group of events can be 
dealt with at one time -—- the system can only be in one state at a 
time. The group operator (GRO) is used to switch the Satellite 
Emulator to a different event group in response to the event 
detector. If no group number is assigned, the system will default 
to group l. 


e Possible Event Groups:* 
Group 1 =AC1.1, AC2.1, DC1.1, DC2.1, Sl.1, S2.1, LSA.1, CTL.l 
Group 2 =AC1.2, AC2.2, DC1.2, DC2.2, S1.2, S2.2, LSA.2, CTL.2 
Group 3 =AC1.3, AC2.3, DC1.3, DC2.3, $1.3, S2.3, LSA.3, CTL.3 
Group 4 =AC1.4, AC2.4, DC1.4, DC2.4, $1.4, S2.4, LSA.4, CTL.4 


* Any valid combination of comparators can be used but all must be 
from the same event group. Event groups are signified by adding 
en (1, 2, 3, or 4) to the comparator as above. 


e Simple WHEN/THEN Statement (no event group specified, defaults to 
group 1): 
WHE[N] <event> THE[N] <action 

any comparator or 

valid combination 

formed with AND, OR, 

or NOT; must be from 

same event group 


e Event Group WHEN/THEN Statement: 
x WHE[N] <event> THE[N] <actiom 
X=1, 2, 3, or 4 


e Event comparators are assumed to be AC1.2 and AC2.2 
>2 WHE[N] ACl OR AC2 THE[N] BRK, TGR<returm 


e@ WHEN/THEN clause assumed to be from group 3. 
>WHE[N] NOT AC1.3 AND NOT DC1.3 THE[N] BRK, RCT, TRC<returm 


e System defaults to group 1 when no group is specified. 
>WHE[N] DCl and AC] THE[N] FSl<returm 
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5.6 


OPTIONAL LOGIC 
STATE ANALYZER 


LSA 


5.6.1 


LSA 
Functions 


e Group 4 comparators. 
>4 WHE[N] AC2 THE[N] CNT<return> 


e To use more than one event group 


.>WHE[N] AC1 AND S1 THE[N] CNT 
>WHE[N] CTL THE[N] RCT, GROUP 2 

>2 WHE[N] AC1 AND Sl THE[N] TRC, CNT 
>2 WHE(N] CTL THE[N] BRK 

>AC1.1 = $4010; AC1.2 = $4011 

>CTL.1 = 3; CTL.2 = $14 (20 decimal) 
>S1.1 = WR; S1.2 = RD 


This example could be used to monitor the activity of an I/O port 
after the port had been initialized. When ACI has been accessed by 
three write cycles, the counter will be reset and the event monitor 
will transfer to group 2. Then twenty read cycles will be traced. 
When count limit is reached the event monitor will break halting 
emulation. 


The Logic State Analyzer option assembly includes a pod, cable, and 
probe clips. It provides you with access to external logic signals 
that can be fed directly into the trace and break card of the 
emulator. This data is qualified and clocked with other trace data 
by the Event Monitor System. (Trace data is displayed by using the 
DRT command.) 


The Logic State Analyzer is used for many applications including: 


e debugging data and address lines on the other side of the CPU 
buffer 


e debugging decode lines 
e keeping track of memory management 
e debugging 1/0 
e address and chip select decoding 
The LSA comparator is assigned with an assignment statement, just 
as the address comparators are. It is 1l6-bits wide; Don’t Care 
bits are permissible. 
e To monitor a specific activity outside the microprocessor 
This example will turn on trace when an activity occurs and turn 
off the trace when the activity is terminated. The two event 
groups are required to specify the on and off conditions. 
>WHEN LSA THEN TOT, GRO[UP]2 
>2 WHEN LSA THEN BRK 


>LSA.1 = $0000 DC SFFFE 
>LSA.2 = $0001 DC $FFFE 


5.6.2 Timing 
Strobe 


CPU State 
CPU Clock 


BCR 

Bus Cycle 
Request 
Event 

TGR Output 
Tl 

T2 

T3 

T4 


This example waits for the logic state analyzer, Bit 0 to go low 
and then uses the toggle trace command (TOT) to turn on trace 
memory, and GRO[UP]2 to switch groups. In group 2 all bus cycles 
are traced until LSA pod Bit O goes high. Then emulation is 
_ broken. 


The ES uses a bus request signal (shown in the figure 5-2.) to gen- 
erate a trigger which is sent to the LSA pod and to the BNC connec— 
tor on the rear panel. The trigger is a low-going-high signal for 
approximately one bus cycle and is generated approximately 70 ns 
after an event. 


If you do not have the LSA pod, you can still take advantage of the 


trigger through the BNC connector for use with signature analysis 
equipment, a logic analyzer, or an oscilloscope: 


e With an oscilloscope, the trigger could be used to flag a loop or 
I/O routine. 


e With a signature analyzer, you can use the trigger to provide 
start and stop pulses, from the LSA pod or the BNC connector. 


Another use for the trigger would be to connect two emulators, 
using the signal from the first to trigger a break in the second 
emulator. The Event Monitor System would be programmed as shown: 


e Emulator 1: WHE[N] <event> THE[N] TGR 


e Emulator 2: WHE[N] LSA THE[N] BRK 
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SECTION 6 


INTERFACING AND COMMUNICATIONS 


6.1 
6.2 


6.3 


6.4 


INTRODUCTION 
SERIAL DATA REQUIREMENTS 


SETTING SYSTEM CONTROL 
6.3.1 Terminal Control 
6.3.2 Computer Control 
6.3.3 Transparent Mode 


ae TRANSFER AND MANIPULATION 
6.4. Upload and Download 


6.4.2 Verify 


6.1 INTRODUCTION 


6.2 SERIAL DATA 
REQUIREMENTS 


This section gives information necessary for interfacing and 
communication between the Satellite Emulator and other units in an 
emulation system. Information includes: 


e serial data requirements 


e setting system control 


e data transfer and verification 


Specifications for the serial data formats are located in Appendix 
A. 


The Satellite Emulator is compatible with RS232C standard pin 
conventions and signaling levels (given in section 2.3.3). 


The standard software transmits and receives ASCII characters 
requiring seven-bit representation. One stop bit is recommended 
for most uses; however, some data terminals require two for proper 
operation. 


The format of a serial word is shown in Figure 6-1. When no data 
is being transmitted, the Serial Data Out pin will be at the 12 
volt level (marking). When the Satellite Emulator sends a 
character, there will always be a start bit, followed by 7 or 8 
data bits, and 1 or 2 stop bits. The number of data bits and stop 
bits are specified by command, described in the operation section 
for the microprocessor you are using. 


The Satellite Emulator sends and checks parity according to system 
set-up parameters. 


Two additional signals used by the emulator are the Request to Send 
(pin 4) output and the Clear to Send (pin 5) input. The software 
uses these signals to coordinate data transfer. When the emulator 
is ready to begin receiving data, it changes the Request to Send 
line from low to high and awaits data transmission. When it has 
finished receiving data, it returns the Request to Send line to the 
low state. When the emulator is ready to send a character, the 
software tests the condition of the Clear to Send line. When used 
in conjunction with XON and XOFF, transmission of the character is 
provided only if Clear to Send is in the high state; the character 
is held if the signal is in the low state. Thus, a receiving unit 


May control the transfer of data by taking the Clear to Send line 


high when more data is desired and low when not ready for data. 
The ASCII control characters, XON and XOFF, are recognized by the 
emulator. 


Figure 6-l. 
Format of a Serial Word 


6.3 SETTING SYSTEM 


CONTROL 


6.3.1 


6.3.2 


Terminal 
Control 
TCT 


Computer 
Control 
CCT 


=12V. START DO O01 D2 O3 OD4 DS D6 O07 STOP START DO 
— 4 ee enn aes nn -_-— 
| | | | | | | | | 
| | | | | | | | 
—_! ee ee ee oe —_ 
: t : t = time of one data element or baud 


The Satellite Emulator can operate under CRT terminal or host 
computer control, or can become transparent, allowing the CRT 
terminal to communicate directly with a host computer. 


This operator is entered from a host system interfaced through the 
computer port, only when the Satellite Emulator is in the host 
system control mode. Control is transferred to the CRT terminal 
and away from the host system. This overrides the setting of the 
interface parameter switch. 


This operator, analogous to the Terminal Control operator, is 
entered from a CRT terminal interfaced through the terminal port, 
only when the emulator is being controlled via a CRT terminal. 
Control is transferred to a host system interfaced through the 
computer port. This overrides the setting of the interface 
parameter switch. 


There are four characteristics to remember about CCT. 

e First, the emulator will echo most of the characteristics sent to 
it, so the computer can use this feature to check the data 
transmission. 

e Second, when the host sends a RETURN, the emulator begins 


processing the command line. New lines generally begin with 
RETURN LINEFEED NULL NULL. 
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6.3.3 Transparent 
Mode 
TRA 


Example 6-1. 
Terminal Control, 
Computer Control and 
Transparent Mode 


e Third, the host must be able to handle incoming data at high 
rates as the emulator will be sending at 960 characters/second 
(9600 baud); the host should be able to send XON/XOFF to the 
emulator. 


e Fourth, UPL (upload) and DNL (download) expect data from the same 
“port whether you are using TCT or CCT: if you are downloading, 
. the emulator always expects data to come from the host, and if 

you are uploading, data is always sent to the host. 


NOTE: 


If you execute CCT in error, turn the 
emulator off, then on again. 


This operator instructs the emulator to become’ transparent, 
aliowing the CRT terminal interfaced through the terminal port to 
communicate directly with a host system interfaced through the 
computer port. TRA can be entered while in either Terminal or 
Computer Control modes. 


The Terminal Control and Computer Control operators are used to 


switch control back and forth between a host system and CRT 
terminal. The Transparent operator allows you to bypass the 
Satellite Emulator and communicate directly between your CRT 
terminal and host system. The emulator acts only as an interface. 
In this mode the emulator can buffer up to 64 characters for each 
port and can operate the ports at independent baud rates. 


Refer to the system configuration shown in Figure 6-2. The initial 
physical connection is made according to the procedures outlined in 
Section 2. Original control is set with the interface parameter 
switch. 


With the set-up complete, we will start with the CRT terminal 
controlling the Satellite Emulator. This is done by having the 
interface parameter switch in any position but those that are for 
computer control (positions 3 and 4 are for computer control). 


o If you now want to switch control to the host system, despite the 
fact that the switch is positioned for terminal control, you will 
enter: 

>CCT<returm 


o To go back to terminal control, enter at the computer port: 
>TCT<returnm> 


o If you want to communicate directly between the CRT terminal and 
the host system, enter from the controlling port: 


>TRA<returm 


6-4 


Figure 6-2. 
System Control 


6.4 DATA TRANSFER AND 
MANIPULATION 


6.4.1 Upload and 
Download 
UPL 
DNL 


CRT 


HOST 
COMPUTER EMULATOR TERMINAL 


1. CCT switches control to computer. 

2. TCT switches control to CRT terminal. 

3. TRA (entered from controlling port) allows communication directly between CRT terminal 
and computer. 


These commands are used for moving data in and out of the emulator 
and manipulating data within. Formats are described in Appendix A. 
The commands are: 


@ Upload - UPL 

@ Download - DNL 

e Verify or compare - VFY 
@ Upload Symbols - UPS 


Upload and download operations initiate routines to load the target 
system memory and/or RAM Overlay Memory with data from a host 
system, and to dump data from the target system address space to a 
host system and/or RAM Overlay Memory. 


The Satellite Emulator will download in either a software handshake 
or no-handshake mode. While the no-handshake mode is faster and 
very simple, the handshake mode offers verification that data is 
received correctly and allows resending of data that is received 
bad. 


In an Upload operation, data is transferred from the emulator to a 
host computer or other peripheral interfaced to the Satellite 
Emulator computer port. A Download, conversely, moves data from a 
host computer to the emulator. 


The following steps are necessary to Upload data from the emulator 
to a host computer or other peripheral. 


e Type TRA <return>. This puts the ES in the transparency mode for 
entering a command line to the host computer and prepares it to 
receive a file. Note that this TRA command is not necessary when 
using and uploading to a hard copy printer. Do not enter a 
<return> at the end of the line. Instead, type in the two- 
character transparency escape code. This code returns the 
emulator to its normal communication status with the user and 

-causes the emulator to send the host computer a "command line 
terminator." The host computer (or other peripheral) should now 
be ready to accept data. 


e Enter the Upload command for the desired range or the Upload 
Symbols command (see Example 6-2. Upload and Download). The 
emulator will now dump data to the computer port in the download 
format specified in the Set Menu. Refer to Table 3-5. 


Typing the DNL command at the terminal causes two things to happen. 
First the emulator readies itself to receive data; then it goes 
into a "transparent" mode (like the TRA operator described 
previously, though accomplished here without the TRA command), 
allowing the CRT terminal to communicate directly with the host 
computer. This is necessary to allow you to enter the command line 
necessary to tell the host computer to send data to the emulator. 
Do not enter a <return> at the end of this line. Instead, type in 
the two-character transparency escape code. As data records are 
received, they are displayed on the CRT terminal. The command line 
terminator, transparency escape code, and the serial data format 
are user-defined with the Set-Up command, described in Section 3. 


If the DNL operator is issued by the host computer (in computer 
control mode), the process is somewhat different. The emulator 
will not go into transparent mode and data records will not be 
displayed on the terminal. However, after successful reception and 
storage of every data record, the emulator will respond to the host 
with an ASCII ACK (6) character. Thus, to monitor the download 
process, the host should send one record, then wait for a response. 
If the response is the ACK, the host should continue with the next 
data record. 


If the response is not the ACK, the emulator will have detected an 
error or End of File condition. In the case of the EOF, the 
emulator will return the normal prompt because the data transfer is 
complete. 


If the Satellite Emulator has detected an error, it will respond 
with a <return>, line feed, several spaces, a ?, and a BEL. Then 
it will revert to the normal prompt on a new line. The host can 
then find the cause of the error by sending a ? to the Satellite 
Emulator. 


There are only two errors that can occur during a download. There 
may be a checksum error in the data record. In this case, the DNL 
process is aborted before any data from that record is stored to 
memory. The second type of error is a read-after-write verify 


Example 6-2. 
Upload and Download 


6.4.2 Verify 
VFY 


Example 6-3. 
Verify 


error. Every byte in a data record is verified after it is stored. 
If an error occurs, the DNL process is aborted but some of the data 
in the record has obviously been stored to memory. 


e Upload: 
>UPL<range argument><returm 
 >UPS<return> 
@ Download: 
>DNL<returnm> 
><transparent><commands to computer><escape code> 
This terminates the Transparent mode and the Download occurs. 
Note that the escape code is created with the Set-Up command 
described in Section 2. 


The Verify operator (VFY) compares data received at the computer 
port with memory. Any differences are displayed. The operator 
interaction required is similar to the Download command. The VFY 
command does not display incoming data records. See the following 
example. 


e The format for Verify operator is: 
>VFY<returm 


e Any differences will be displayed as: 
address = XX NOT YY 


In the above example, the address is the address where the 


misverify occurred. XX denotes the actual data present at that 
location. YY denotes what should be at that location. 
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SECTION 7 
DIAGNOSTIC FUNCTIONS 


721 INTRODUCTION 


7.2 RAM DIAGNOSTICS 

1 SF #0, <RANGE> 
-2 SF #1, <RANGE> 
-3 SF #2, <RANGE> 
4 SF #3, <RANGE> 
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S 
rg 
ta 


LOOPS 

SF #4, <ADDR><DATA> 
SF #5, <ADDR> 
SF #6, <ADDR> <DATA> 
SF #7, <ADDR>, <PAT-1>, <PAT-2> 
SF #8, <ADDR>, <PAT> 
#9, <ADDR>, <DATA> 
SF #10, <RANGE> 
SF #11, <ADDR> 
SF #12, <RANGE> 
~10 SF #13, <returm 
7.4 CLOCK AND CRC 


a i a ee ee Oe ee 
e 
WWW WW WW W& Ww Ww 
e 
KH OMNAUF WHE 
wn 
ry 


7.5 BUS 


7-6 COM AND DIA 


7-1 


7.1 INTRODUCTION 


7.2 RAM TESTS 


72-1 SFO, 
<RANGE> 
<RETURN> 


7.2.2 SF 1, 
<RANGE> 
<RETURN> 


7.2.3 SF 2, 
<RANGE> 
<RETURN> 


7.2.4 SF 3, 
<RANGE> 
<RETURN> 


7.3 SCOPE LOOPS 
(MEMORY, I/0) 


The Special Functions are a group of utility routines and diagnos- 
tic tests invoked with the Special Function (SF) operator. These 
routines are used for debugging hardware or accommodating unusual 
hardware conditions. 


These routines are "canned" RAM tests that can be run on the target 
or RAM Overlay system. The tests are executed in byte mode. 


This routine involves three steps. First, the RAM test consists 
of writing a zero to the test cell and then reading the cell to see 
if a zero exists. Next, a one is used for the test pattern 
followed by $3, $7, $F, SIF, S$3F,..., SFFFF, SFFFE, SFFFC,..., 
$cO00, $8000. Finally if a failure is detected, the problem 
address, correct data and faulty data are displayed. This routine 
can be aborted by resetting the emulator but will finish after a 
single pass. 


Executes a complete RAM test over the words within the specified 
range. The test was derived from a study by Nair, Thatte and 
Abraham entitled "Efficient Algorithms for Testing Semiconductor 
Random—Access Memories: (IEEE Transactions on Computers, vol. c-27, 
no. 6 June 1978). The test corresponds to their algorithm "A" and 
is more efficient than standard "GALPAT" type tests. If an error 
is detected by this test, the associated address, good data, bad 
data, and test sequence number are displayed. The sequence number 
corresponds exactly to the sequence numbers suggested in the 
article, but if you do not have the article, the above information 
should be sufficient. This is a single-pass test that can be 
aborted by resetting the emulator. 


Continuously executes the test described for "SF #0" above. While 
executing the test, a pass count is maintained and displayed on the 
screen. The count is updated by rewriting the display line without 
using a "linefeed." Thus, intermittent errors will not be pushed 
off the screen by the pass count. You must reset the emulator to 
terminate this test. 


Executes the RAM test described in "SF #1" above, continuously over 
the words in <RANGE>. A pass counter is displayed as described in 
"SF #2."" You must reset the emulator to terminate this test. 


Scope loops are diagnostic routines built into emulator firmware. 
The uses for these special functions range from locating stuck 
address, data, status or control lines to generating signatures 
using common signature analysis equipment. 


The routines for Scope Loops are executed at maximum speed. This 
short cycle time allows the hardware engineer to easily view the 
timing of pertinent signals in the target system without using a 
Storage type oscilloscope. All of these routines must be 
terminated by resetting the emulator. The scope loops can be 
executed in byte or word data lengths. The data length will be the 
global default. 
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SF 


SF 


SF 


SF 


SF 


SF 


SF 


SF 


5 25 B/W 
6 26 B/W 
7 27 B/W 
8 28 B/W 
9 29 B/W 
10 30 B/W 
11 31 B/W 
12 32 B/W 


7.4 CLOCK AND CRC 


CLK <RETURN> 
CRC <RETURN> 
CRE/CRO <RANGE> 
<RETURN> 


As with the RAM tests, these scope loops access the memory space 
defined by the last setting of MMS (memory mode status). The 
following paragraphs describe each of the different scope loops. 


NOTE 


| All special functions for the 80188 are 
executed in BYM (byte mode). 


MEMORY AND I/O SCOPE LOOPS 


Memo I/O Parameters Required Description 
SF 4 24 B/W <addr><data><returm Writes alternating zeroes and user specified 


<addr><returm 


<addr><data><returm 


<addr><pat><returm> 


<addr><pat><returm 


<addr><data><returnm> 


<range><returm> 


<addr><data><returm 


<range><returm 


data to the target system. 


Executes "reads" into the target system. 
(Peeks) 


Executes "writes" into the target system. 
(Pokes) . 


Writes pattern to the target system, then 
complement pattern. 


Writes the pattern to the target system but 
the pattern is rotated one bit left after 
each "write." 


Writes the supplied data to the target system 
and then reads it from the target system at 
the same address. Data read from the target 
system is ignored by the ES. 

Forces NOPs to the target system. 


Writes an incrementing count value to a 
constant address. 


Read data over entire range. 


The CLK and CRC operators will be useful during diagnostic testing. 
CLK reads the target system clock and returns the value in KHz, 
accurate to 1 to 2 KHz. 


CRC computes a cyclic redundancy check over an address range. It 
will be useful for checking if a block of memory has changed. The 
key sequences are shown in this example: 


If your code is split into two PROMS with one even and the other 
one odd, the CRE/CRO operators allow you to do a cyclic redundancy 


check over each PROM. 


*NOTE 


For Diagnostic purposes CRC will function for byte 


or word. 


Also, the CRC value may be calculated over 


only odd addresses or only even addresses. 
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Example 7-l. 
Clock and CRC 


7.5 


7.6 


Bus 
BUS 


COM AND DIA 
COM 


e To read the target system clock: 
>CLK<return> 


@ To compute the CRC: 
>CRC <address range><returm 


e To calculate a CRC over even bytes only: 
>CRE <address range><returm 


e To calculate a CRC over odd bytes only: 
>CRO <address range><returm 


BUS displays the status of several status lines. For example: 
e >BUS 


NMI ARDY  SRDY INTO INTI1 INT2/INTAO INT3/INTAI1 TEST 
0 0 0 0 0 0 0 0 


(In this example, "0" indicates a no-fault condition; a fault 
condition would be indicated by "1)." 


COM allows you to communicate directly with a program running in 
the target system. COM allows the simulation of communication 
between the target system program and a serial interface (usually 
the ES control terminal, sometimes another computer attached to the 
ES). 


The routine is invoked with a simple 32-bit argument, the address 
of a 2-byte "port" in target memory. 


e The first byte is for characters coming from the target program. 
the MSB of this byte is used to indicate "new character" to the 
ES. If the bit is set, this routine will read the character, 
display it on the controlling port, and clear the target memory 
location (as a handshake). 


e The second byte is the write byte. If a character arrives from 
the controlling port, the routine will place it in the target 
memory with the MSB set. The routine will terminate only when 
the terminal transparent mode escape sequence is detected. The 
routine does not check to see if the last character written to 
the target system was accepted. 


As examining target memory requires that emulation be halted for 
about 180 microseconds, COM will wait 1/2 second between target 
System reads. However, if a character is placed in the output port 
byte by the target system program, COM will collect the character, 
reset the MSB and re-examine the port as soon as the character has 
been put into the output UART buffer. COM will also immediately 
examine the output port whenever it places a character in the input’ 
port. 
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DIA 


DIA allows you to display, on your controlling device, a string of 
characters which are stored in target memory. This routine is 
invoked with a simple 32-bit argument. 


e-The 8 MSB’s of the argument contain the expected stop characters. 


e The lower 24-bits contain the address of the first character of 
' the message. 


DIA begins with a RETURN or a line feed. The routine then reads 
one byte at a time from your target system, starting with the 
address you specified and working towards high memory. The 
characters are displayed on the controlling port (usually the ES 
controlling CRT). 


The DIA routine is completed when the character read matches the 
stop character. 


SECTION 8 
4AINTENANCE AND TROUBLESHOOTING 


8.1 MAINTENANCE 
8.1.1 Cables 


8.1.2 Probe Tip Assembly 


8.2 TROUBLESHOOTING 


8.3 PARTS LIST 


8.1 MAINTENANCE 


8.1.1 Cables 


8.2 TROUBLESHOOTING 


Maintenance of the ES-Series Satellite Emulator has been minimized 
by the extensive use of solid-state components throughout the 
instrument. 


The interconnect cables are the most vulnerable part of the instru- 
ment due to constant flexing during insertion and extraction. 
First, inspect the cables for any obvious damage, such as cuts, 
breaks, or tears. Even if you have thoroughly inspected the cables 
and cannot find any damage, there may be broken wires within the 
cables (usually located close to the ends). A broken wire within 
the cable will cause the instrument to run erractically or inter- 
mittently if the cables are flexed during the "RUN" mode. By 
Swapping the cables in question with a known good set of cables, 
you can easily isolate the faulty cable. The parts list at the end 
of this section contains cable part numbers if you need to order 
replacements. 


Your emulator is equipped with diagnostic test routines. The 
diagnostic programs are described in Section 7; if you need to 
perform any specific test, you should refer to the description in 
Section 7. Before starting troubleshooting procedures, be sure 
that interconnect cables are installed properly in a compatible 
target system, with power applied to both the target system and the 
emulator. 


The most common problems encountered are listed in Table 8-1. We 
recommend that you contact Customer Service for ES Emulators at 
Applied Microsystems Corporation if you experience any problems 
that do not fall within this range of items. Before you call our 
service department, display your software revision number by 
typing: 


REV 
You will be asked for this information when you call. 


>REV 
Thu Oct 11 13:44:32 PDT 1984 - ESL 2.10 
Tue Oct 16 17:11:50 PDT 1984 - FW 3.6 


NOTE: 
We do not recommend a component-level repair in 


the field, unless performed by a qualified ser- 
vice engineer. 
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Table 8-l. 
Troubleshooting SYMPTOM 


Target system 
runs erratically 


Emulator will 
not communicate 
over RS-232 line 


Target system will 
not run 


Unable to perform 
download 


POSSIBLE CAUSES 

1. Faulty interconnect cables 

2. Emulator and target system 
not compatible 


3. LDV not executed before RUN 
(vector not loaded). 


1. Baud rate set incorrectly 

2. Target system requires "null" 
modem cable (pin 2 and pin 3 of 
RS-232 connector) reversed. 

1. Cables plugged in wrong 

2. Faulty interconnect cables 

1. Transparent mode escape 
sequence not compatible 
with host 

2. Host computer and computer 
port of ES need to be set 
at 4800 baud 


3. Wrong serial data format 
selected 


SECTION 


8.1 


3.5 
#15/23 


3.5 #20 


3.5 #26 


: Call Applied Microsystems (Customer Service for ES Emulators) 
Check Target System 


3.3 PARTS LIST The following parts are available for you to order: 


Part 
Short Cable Set 
Long Cable Set 


Number 
600-11501-00 
600-11142-00 


APPENDIX A 
SERIAL DATA FORMATS 


The following “sections detail the five serial data format compatible with the 
Satellite Emulator. Each is illustrated in the accompanying figures. 


A.1 MOS TECHNOLOGY FORMAT 
A.2 MOTOROLA EXORCISOR FORMAT 

A.3 S-RECORD OUTPUT FORMAT 

A.4 CREATION OF S—RECORDS 

A.5 INTEL INTELLEC 8/MDS FORMAT 

A.6 SIGNETICS ABSOLUTE OBJECT FORMAT 
A.7 TEKTRONIX HEXADECIMAL FORMAT 


A.8 EXTENDED 


A-1 


A.l1 MOS TECHNOLOGY 
FORMAT 


Figure A-l. 
Specifications for 
MOS Technology 
Data Files 


The data in each record is sandwiched between a seven-character 
prefix and a four-character suffix. The number of data bytes in 
each record must be indicated by the byte count in the prefix. The 
input file can be divided into records of various lengths. 


Figure. A-l1 simulates a series of valid data records. Each data 
record begins with a semicolon (;). The Satellite Emulator ignores 
all characters received prior to the first semicolon. All the 
characters in a valid record must be valid hex digits (0 through 9 
and A through F). A two-digit byte count follows the start 
character; the byte count, expressed in hexadecimal digits, must 
equal the number of data bytes in the record. The next four digits 
make up the address of the first data type in the record. Data 
bytes follow, each represented by two hexadecimal digits. 


The suffix is a four-character checksum, representing the sixteen- 
bit binary sum of ail hexadecimal bytes in the record, inciuding 
the address and byte count. Carry from the most significant bit is 
dropped. 


INPUT 
DATA RECORD END OF FILE RECORD | 


START CHARACTER 


Byte Count BC = O0:n Enaot Fie Aecorg 
BC = Byte Count The nenadec: mai tumober of data Bytes 


in the recorc 


Aecorg Cou? 


AAAA =: Address of frst data Dvte ~ fer grd AAAA 
Hexadec: Mai notatan oniy 


HH = One data byte -9 Nexacec na! outa! or 


a vevefoel 


START CHARACTER es 
8 
c 
a 
R 
R 
R 
Cc 
c 
c 
c 


OUTPUT 
NOTES 


1) Number of twtes per recora svaranie See Table 3) 
2) Each ne ends with nono nt agi ne teed carriage return 


CCCC = Checksum Twooyte ninary summation of 
Preceding bytes 1m record (-ncludrg adaress and date 
Dy tes! 9 Mewadecimal notat.or ond quills 
This soace can be used for ine teec “att age returns or 
comments 


2 Mea characters 1 Dyle Data Records 


i —— Ae 


(Seginn:ng of next recora?! -~ 
BC AAA AHHHHHHHHMHHH HHH MMM MMMM MH HM HMM MHHCCCC 


BC AAAAHHH HHH HH MH NM HMA HHH HMMM MH Me MCCCC 
BC ARR ABA Hdd td de dd dd Md A de COCO 
BC AAA AHHH HHH MHA HH HH HH AHH HAH RH HCCOC 
BC AAA AHHMHHH HHH HHH MHA AHA HHA HR MCCCC 
“lo eT DDlsilo lala ial \ 
BCA AA AHHHHHHNHHHHNHHHHHHHH RM MMM MRM HCCCC 
BCRRARCCCC 


LEGEND 


= Start Character 
6c = Byte Count (8C> 00 in Recora BC = OO sn End of Fite Recora? 
AAAA = Address Fieta 
cecce = Checksum of Record 
RRAR + Record Counr 
HH = Two Hexadecimal Oigits (09. A FI 
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A.2 MOTOROLA 


EXORCISER FORMAT 


Figure A-2. 
Specifications for 
Motorola EXORciser 
16-BM Data Files 


Motorola data files may begin with a sign-on record, initialized by 
the code S@. Valid data records start with an eight-character 
prefix and end with a two-character suffix. Figure A-2 demon- 
strates a series of valid Motorola data records. 


Each data record begins with the start characters, "S1"; the 
emulator will ignore all earlier characters. The third and fourth 
characters represent the byte count, expressing the number of data, 
address, and checksum bytes in the record. The address of the 
first data byte in the record is expressed by the last four 
characters of the prefix. Data bytes follow, each represented by 
two hexadecimal characters. The number of data bytes occurring 
must be three less than the byte count. The.suffix is a two- 
character checksum. 


INPUT 
DATA RECORD Gat at, we 
ey eee SQ Starr characters of sign on record Excent tor start cmaracters 

8 

Cc 

A 

a 

A 

A 

Lal 

H 

H 

Lal 


SO record nas same tormat as data record 


BC: Byte Court The numober of data ny'es plus 3 [1 for 
checksum and 2 for address! :n hexadec-ma! rotator 


ENO OF FILE RECORD 


ABBA = Adaress of first data byte «7 record AAAA in 
hexadecimal notation arly 


START CHARACTERS 


Bete Count BC - O35 End ot F 2 Record 
HH = One data byte in Pexadec mai notation 


Actress 


: 
| 3. Sgn an vecora ay orecede cata 
2 Hex characters 1 vie Data Records 


= Optionai Record Start Characters 
= Start Characters 
= Byte Count 

{[Data Bytes/Record! + 3) 
= Adaress of First Data Byte 
= Two Hexadecimal Digits '0 9. AF! 
= Checksum of Record tone nyte! ~ 


SIBCAAAAHHHHHHHHHHH AHH HAHAHAHAHAHA HHH 
SIBCAAAAHHHHHHHHHHHHHHHAHAH HAHAH RRR HHAHCC 
SIBCAAAAHHHHMHHHHHHH AHHH AHH HAH HMMM CC 
SIBCAAAAHHHHHHHHHH HMMA HAHAHAHA M HH HAHAH HHH 
S9BCAAAACC 


Checksum 
> CC = Checksum Ones comntement of ninary sum™mat ar 
c of preceding bytes 1n record (ynciud-ng ny 'e Cour address 
Cc and datz bytes! «9 Nexadec-:ma norat:or 
This space can be used tor ‘ine feeg carr.age mtu OUTPUT 
comments U 
NOTES 
{Beginning of next record) 
Te Numoper st nyt) ner mer rd 5 ear anle See Table 3) 
2) Each ve ends wth soem nt ng ise feed car:-age retura 
and rul!s 
so . 
$1 
BC 
AAAA 
HH 
ce 
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A.3 S-RECORD OUTPUT 
FORMAT 


A. 3 e 1 S-RECORD 
CONTENT 


A.3.2 S-Record Types 


The S-record format for output modules was devised for the purpose 
of encoding programs or data files in a printable format for 
transportation between computer systems. The transportation 
process can thus be visually monitored and the S-records can be 
more easily edited. 


When viewed by the user, S-records are essentially character 
strings made of several fields which identify the record type, 
record length, memory address, code/data, and checksum. Each type 
of binary data is encoded as a 2-character hexadecimal number: the 
first character representing the high-order 4 bits, and the second 
the low-order 4 bits of the byte. 


The 5 fields which comprise an S-record are shown below: 


type record length address code/data checksum 
where the fields are composed as follows: 


PRINTABLE 
FIELD CHARACTERS CONTENTS 


type 2 S-record type --SO, Sl, etc. 


record length 2 The count of the character pairs in the 
record, excluding the type and record 
length. 


address 4, 6, or 8 The 2-, 3-, or 4—byte address at which 
the data field is to be loaded into 
memory. 


code/data 0-2n From 0 to n bytes of executable code, 
memory-loadable data, or descriptive 
information. For compatibility with 
teletypewritters, some programs may 
limit the number of bytes to as few as 
28 (56 printable characters in 
S-record). 


checksum Z The least significant byte of the one’s 
complement of the sum of the values 
represented by the pairs of characters 
making up the record length, address, 
and the code/data fields. 


Each record may be terminated with a CR/LF/NULL. Additionally, an 
S-record may have an initial field to accommodate other data such 
as line numbers generated by some time-sharing systems. 


Accuracy of transmission is ensured by the record length (byte 
count) and checksum fields. 


Eight types of s-records have been defined to accommodate the 
several needs of the encoding, transportation, and decoding 
functions. The various Motorola upload, download, and other 
file-creating or debugging programs, utilize only those S-records 
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A.4 CREATION OF 
_ §-RECORDS 


which serve the purpose of the program. For specific information 
on which S-records are supported by a particular program, the 
user’s manual for that program must be consulted. 


An S-record format module may contain S-records of the following 
types: . 


SO The header record for each block of S-records. The code/data 
field may contain any descriptive information identifying the 
following block of S-records. Under VERSAdos, the resident 
linker”s IDENT command can be used to designate module name, 
version number, revision number, and description information 
which will make up the header record. The address field is 
normally zeroes. 


Sl A record containing code/data and the 2-byte address at which 
the code/data is to reside. 


S2 A record containing code/data and the 3-byte address at which 
the code/data is to reside. 


S3 A record containing code/data and the 4-byte address at which 
the code/data is to reside. 


S5 A record containing the number of Sl, S2, and S3 records 
transmitted in a particular block. This count appears in the 
address field. There is no code/data field. 


S7 A termination record for a block of S3 records. The address 
field may optionally contain the 3-byte address of the 
instruction to which control is to be passed. There is no 
code/data field. 


S8 A termination record for a block of S2 records. The address 
field may optionally contain the 3-byte address of the 
instruction to which control is to be passed. There is no 
code/data field. 


S9 A termination record for a block of $l records. The address 
field may optionally contain the 2-byte address of the 
instruction to which control is to be passed. Under VERSAdos, 
the resident linker”’s ENTRY command can be used to specify this 
address. If not specified, the first entry point specification 
encountered in the object module input will be used. There is 
no code/data field. 


Only one termination record is used for each block of S-records. 
S7 and S8 records are usually used only when control is to be 
passed to a 3- or 4-byte address. Normally, only one header record 
is used, although it is possible for multiple header records to 
occur. 


S-record-format programs may be produced by several dump utilities, 
debuggers, VERSAdos~ resident linkage editor, or several cross 
assemblers or cross linkers. On EXORmacs, the Build Load Module 
(MBLM) utility allows an executable load module to be built from 
S-records and has a counterpart utility in BUILDS, which allows an 
S-record file to be created from a load module. 
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Several programs are available for downloading a file in S-record 
format from a host system to an 8-bit microprocessor-based or a 
16-bit microprocessor-based system. Programs are also available 
for uploading an S-record file to or from an EXORmacs system. 


Example 


Shown below is a typical S-record-format module, as printed or 
displayed: 


$0060000484421B 
$1130000285F245F2212226A000424290008237C2A 
$11300100002000800082629001853812341001813 
$113002041E900084E42234300182342000824A952 
$107003000144Ed492 

S9030000FC 


The module consists of one S@ record, four Sl records, and an S9 
record. 


The SO record is comprised of the following character pairs: 
SO S-record type SO, indicating that it is a header record. 


06 Hexadecimal 06 (decimal 6), indicating that six character 
pairs (or ASCII bytes) follow. 


a } Four-character 2-byte address field, zeroes in this example. 
48 

44 } ASCII H, D, and R - "HDR". 

52 

1B The checksum. 


The first Sl record is explained as follows: 


Sl S-record type Sl, indicating that it is a code/data record 
to be loaded/verified at a 2-byte address. 


13 Hexadecimal 13 (decimal 19), indicating that 19 character 
pairs, representing 19 bytes of binary data, follow. 


00 } Four-character 2-byte address field; hexadecimal address 
00 0000, where the data which follows is to be loaded. 


The next 16 character pairs of the first $l record are the ASCII 
bytes of the actual program code/data. In this assembly language 
example, the hexadecimal opcodes of the program are written in 
sequence in the code/data fields of the Sl records: 


OPCODE INSTRUCTION 

285F MOVE.L (A7) +,A4 

245F MOVE.L (A7) +,A2 

2212 MOVE.L (A2),D1 

226A0004 MOVE.L 4(A2),Al 

24290008 MOVE.L FUNCTION(A1) ,D2 

237C MOVE.L #FORCEFUNC, FUNCTIONAL ) 


o (The balance of this code is continued in the 
code/data fields of the remaining Sl records, 
and stored in memory location $419, etc.) 


2A The checksum of the first Sl record. 

The second and third Sl records each also contain $13 (19) 
character pairs and are ended with checksums 13 and 652 
respectively. The fourth Sl record contains $7 character pairs and 
has a checksum of 92. 

The S9 record is explained as follows: 


$9 S-record type $9, indicating that it is a termination record. 


$3 Hexadecimal $3, indicating that three character pairs (3 bytes) 
follow. 


He The address field, zeroes. 


FC The checksum of the S9 record. 


Each printable character in an S-record is encoded in hexadecimal 
(ASCII in this example) representation of the binary bits which are 
actually transmitted. For example, the first Sl record above is 
sent as: 
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A.5 INTEL INTELLEC Intel data records begin with a nine-character prefix and end with 
8/MDS FORMAT a two-character suffix. The byte count must equal the number of 
data bytes in the record. 


Figure A-3 simulates a series of valid data records. Each record 
begins with a colon (:), followed by a two-character byte count. 
The Four digits following the byte count give the address of the 
first data byte. 


Each data byte is represented by two hex digits; the number of data 
bytes in each record must equal the byte count. 


The suffix is a two-digit checksum, the two’s complement of the 
binary summation of the previous bytes in the record. 


INPUT 
DATA RECORD END OF FILE RECORD 


START CHARACTER START CHARACTER 


BC = Byte Count: The hexadecimal number of ueta bytes 


in the record Byte Count BC 06.7 Endot Fe Record 


AADA © Address of frst data Ovie on recurct AAAA 1 


Hexadecimal natation oniy aad 
BARA » 0000 . 
TT Record Type (00) 
TT Record Tyue iOts 
T TT = 02 HH One sata byte 9 Mewatter Mal cutat o 
T 
HAMM « Offset vatue 
CC: Checksum Negation (wos comorement: of Inrary OUTPUT 
. summaton of preceding nytes nm recom! iinciuntcg nyt 
c Count address, and data byfesi .- NexadeciMa: notation i NOTES 
This space can be used for one feed carrage veturn oF 
comments, 1 Numoper of oy'es oer records var aole See Tapie 3! 
c CC » Checksum 2) Eacm | ne ends win aonor stagione fred carrage return 
c 37d wuld 
2 i4ex characters | Dy te Data Records 


= Start Character BCAAAAT THHMHHRHMHH HHH HMMM HHH HH HHHHH RRC 


6c = Byte Counr (Data Bytes Record BRN ANT TM a dd ad ad dd dt dt dl dd Mt COC [ 
AAAA = Address Field BCAAAAT THH MN HHH HM HMMM MMM HH MMM HAMM MHMRHRHMCO f 
TT > Record Type BCAAAATT \ 
H t One Hexadecimal Digit (09 AF) 

cc = Checksum of Record 


Specifications for 
Intel Intellec 
8/MDS Data Files 


Copyright 1983, Data I/O Corporation; reprinted by permission. 


A-8 


A.6 SIGNETICS ABSOLUTE Figure A-4 shows the specifications of Signetics format files. The 


OBJECT FORMAT 


Figure A-~4. 
Specifications for 
Signetics Absolute 
Object Data Files 


data in each record is sandwiched between a nine-character prefix 
and a two-character suffix. 


The start character is a colon (:). This is followed by the 
address. of the first data byte and a two-digit address check. Data 
is represented by pairs of hexadecimal characters. The byte count 
must equal the number of data bytes in the record. The suffix is a 
two-character data check. Data is represented by pairs of hexa- 
decimal characters. The byte count must equal the number of data 
bytes in the record. The suffix is a two-character data check. 


INPUT 


QATA RECORD END OF FILE RECORD 


ag START CHARACTER 
AAAA = Address of the first dala byte in record AAAA in 


hexadecimal notation on!y Address 


START CHARACTER 


= The hi mal num t 
Bc @ hexadecimal number uf deta dytes in the record Byte Count BC = O0in End of File Record 


AC = Address Check, Every byte 1s exclusive ORed with 
the Drevious byte. then rotated left one Dit 


Hit = One data byte sn hexadecimai notation 
OUTPUT 
NOTES 


11 Number of fytes per record 5 varcable See Table 31 
2) Each ine ends with conprating line feed carriage return 


OC = DataCneck Every bytes exctusiwe ORed vith the and fully 


previous byte. then rotated left one mt 


This space can be used for ine feed carriage return oF 


comments 2 HEX craracters 1 Byte Data Records 


{Beganeng of next record 


AAAABCACHHHHHHHHMHHHHHHHHHHHHHHEHHA HHA HOC 
AAAABCACHHHHAHHHHHMHHMHM MAHA RHA A MOC ( 
AAAABCACHHHHHHHRHHH HMM HHH HAHAHAHA HR OC 
AAAABCACHHHHHHHHHHHHHHHAM HHH HAM HOC \ 
AAAABCAC 


LEGEND 


= Start Character 
AAA = Address Fieia 
Bc > Byte Count (Data Bytes Record! 
AC = Address Check Checksum of address and byte count 
Lala! = Two Hexadecimal Digits (09. AFI 
oc = Data Check Checksum of data in recorg 
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A./ TEKTRONIX 
ADECIMAI 
FORMAT 


Figure A-5. 
Specifications for 
Tektronix Hexadecimal 


Figure A-5 illustrates of valid Tektronix data file. The data in 
each record is sandwiched between the start character, a slash (/), 
and a two-character checksum. Following the start character, the 
next four characters of the prefix express the address of the first 
data byte. The address is followed by a byte count, representing 
the number of data bytes in the record, and by a checksum of the 
address and byte count. Data bytes follow, represented by pairs of 
hexadecimal characters and succeeded by a checksum of the data 
bytes. The end of File record consists only of control characters, 
used to signal the end of transmission, and a byte count and 
checksum for verifications. 


INPUT 
DATA RECORO ABORT RECORD 


= Start Character 
Two Start Characters 


BAAR: Adaress of the first ata Bete One cerurd 
thexadec:mal notaron: 


EF MK Artwtrary steagot ASCH characters, 
BC « Byte Count The newadec:mat numer of tata ny fee 
6 
c n the record 
c CC  Crecksum Eight bit sum at me tour te? Mewaaer me 
Cc 


values of me sm gigits that Make up the adaress and ny ty 
count thexadecima notaton: 


Cort age ceture 


WH = One data byte (7 Meeader Mat tutet on 


ENO DE FE RECGAD 


CO 2 Checksum Entiat se was. SE tee 
four OT Mesadec-mal saises Fo me 1g te yee 
data bytes 


c 
c 
aa 


(Beganing of nex record! 


OUTPUT 
NOTES 
1! Numoer of Bytes Der record's varcamie See Tater J! 


2) Each ine ends wrth nomorneng ine feed carr 
and nulls 


i 
& 


2 Hex characters = | byte 


“~ 


‘WARABCCCHHHH HH rt are MM HH tt re ert eC 
BRAARBCCCHHMH HHH MMM HHH AHHH HHH HH ether CC 
+ RA RBC CCHS Ad dd tt tt test et CO 
RAB CCH IP PEP a bd at dt tt ed td et CO 


-ARAABCEE 


od Teed Meneoee Me Dg 23 ak 
Ary ASC Creracter 


Eng ot Fre Recorg 
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A.8 EXTENDED TEKHEX 


Table A~-l. 
Extended Tekhex 
Header Field 


Extended Tekhex uses three types of message blocks: 


1. 


2a 


A data block contains object code. 


A symbol block contains information about a program section and 


_the symbols associated with it. This information is needed 


only for symbolic debug. 


A termination block contains the transfer address and marks the 
end of the load module. 


NOTE 
Extended Tekhex has no specially defined abort block. To abort 


a formatted transfer, use a Standard Tekhex abort block, as 
defined earlier in this section. 


Each block begins with a six-character header field and ends with 
an end-of-line character sequence (on the 8550, a carriage return). 
A block can be up to 255 characters long, not counting the end-of- 
line. A header field has the format shown in Table A-l. 


NUMBER OF ASCII 


ITEM CHARACTERS DESCRIPTION 


1 A permit sign specifies that the 
block is in Extended Tekhex format. 


Block Length 2 The number of characters in the 


block: a two-digit hex number. This 
count does not include the leading % 
or the end-of-line. 


Block Type 1 6 = data block 
3 = symbol block 
8 = termination block 
Checksum 2 A two-digit hex number representing 


the sum, mod 256, of the values of 
all the characters in the block, 
except the leading %, the checksum 
digits, and the end-of-line. Table 
A-2 gives the values for all 
characters that may appear in 
Extended Tekhex message blocks. 
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Table A-2. 
Character Values 
for Checksum 
Computation 


A.8.1 Variable—Length 
Fields 


A.8.2 Data and 
Termination 
Blocks 


Table A-3. 
Extended Tekhex 
Data Block Format 


CHARACTERS VALUES (DECIMAL) 


0..9 0..9 
Ase L04%35 
S$ 36 
A a7 
-( period) . 38 
_(underscore) 39 
Beez 40..65 


In Extended Tekhex, certain fields may vary in length from 2 to 17 
characters. This practice enables you to compress your data by 
eliminating leading zeros from numbers and trailing spaces from 
symbols. The first character of a variable-length fielid is a 
hexadecimal digit that indicates the length of the rest of the 
field. The digit 0 indicates a length of 16 characters. 


For example, the symbols START, LOOP, and KLUDGESTARTSHERE are 
represented as 5START, 4LOOP and OKLUDGESTARTSHERE. The values 0, 
100H, and FFOOOOH are represented as 10, 3100, and 6FFO0O00. 


If you do not intend to transfer program symbols with your object 
code, you can do without symbol blocks. Your load module can 
consist of one or more data blocks, followed by a termination 
block. Table A-3 gives the format of a data block, and Table A-4 
gives the format of a termination block. 


NUMBER OF ASCIT 


FIELD CHARACTERS DESCRIPTION 

Header 6 Standard header field. Block type = 
6. 

Load Address 2 to l7 The address where the object code is 
to be loaded: a variable-length 
number. 

Object 2n n bytes, each represented as two hex 
digits. 
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Table A-4. 
Extended Tekhex 
Terminal 
Block Format 


A.8.3 


Symbol Blocks 


NUMBER OF ASCIT 


FIELD CHARACTERS DESCRIPTION 

Header 6 Standard header field. Block type = 8. 
Transfer 2 to 17 The address where program execution is 
Address to begin: a variable-length number. 


A symbol used in symbolic debug has the following attributes: 


l. The symbol itself: 1 to 16 letters, digits, dollar signs, 
periods, or symbolize a section name) a percent sign. Lower 
case letters are converted to upper case when they are placed 
in the symbol table. 


2. A value: up to 64 bits (16 hexadecimal digits). 


3. A type: address or scalar. (A scalar is any number that is not 
an address). An address may be further classified as a code 
address (the address of an instruction) or a data address (the 
address of a data item). Symbolic debug does not currently use 
the code/data distinction, so the address/scalar distinction is 
sufficient for standard applications of Extended Tekhex. 


4. <A global/local designation. This designation is of limited use 
in a load module, and is provided for future development. The 
concept of global symbols is discussed in the Assembler Core 
Manuals for both A Series and B Series assemblers. If the 
global/local distinction is not important for your purposes, 
simply call all your symbols global. 


5. Section membership. A section may be thought of as a named 
area of memory. Each address in your program belongs to 
exactly one section. A scalar belongs to no section. the 
concept of sections is discussed in detail in the Assembler 
Core manuals for both A series and B series assemblers. The 
significance of sections with regard to symbolic debug is 
illustrated in the Emulation section of this manual. 


The symbols in your program are conveyed in symbol blocks. Each 
symbol block contains the name of a section and a list of the sym 
bols that belong to that section. (You may include scalars with 
any section you like). More than one block may contain symbols for 
the same section. For each section, exactly one symbol block 
should contain a section definition field, which defines the 
Starting address and length of the section. 


If your object code has been generated by an assembler or compiler 
that does not deal with sections, simply define one section called 
(for example) MEMORY, with a starting address of 0 and a length 
greater than the highest address used by your program; and put all 
your symbols in that section. 


Table A-5 gives the format of a symbol block. Tables A-6 and A-7 
give the formats for section definition fields and symbol defini- 
tion fields, which are parts of a symbol block. 

Copyright 1983, Tektronix: reprinted by permission. 
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Extended Tekhex 
Block Format 


Table A-6. 
Extended Tekhex 
Symbol Block 
Definition Field 


FIELD 
Header 


Section Name 


Section 
Definition 


Symbol 


ITEM 
0 


Base Address 


Length 


NUMBER OF ASCII 
CHARACTERS 


5 to 35 


5 to 35 


DESCRIPTION 
Standard header field. Block type = 3. 


The name of the section that contains 
the symbols defined in this block: a 
variable-length symbol. 


This field must be present in exactly 
one symbol block for each section. 
This field may be preceded or followed 
by any number of symbol definition 
fields. Table A-6 gives the format 
for this field. 


Zero or more symbol definition fields, 
Definition(s) each as described in 
Table A-7. 


NUMBER OF ASCII 


CHARACTERS 


DESCRIPTION 


A zero signals a section definition 
field. 

The starting address of the section: 
a variable-length number. 


The length of the section: a 
variable-length number, computed as 1 
+ (high address base address). 
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Table A-7. 
Extended Tekhex 


Symbol Block: ITEM 

Symbol Definition 

Field 
Type 
Symbol 
Value 


NUMBER OF ASCII 
CHARACTERS 


2 to 17 


2 to 17 


DESCRIPTION 


A hex digit that indicates the global/ 
local designation of the symbol, and 
the type of value the symbol 
represents: 

global address 

global scalar 

= global code address 

= global data address 

local address 

local scalar 

local code address 

local data address 


CONDU HEWN eH 


A variable-length symbol. 


The value associated with the symbol: 
a variable-length number. 


NOTE 


Symbol records are currently ignored by the 
emulator. 


Figure A-8 shows how this information might be encoded in Extended 
Tekhex symbol blocks. (All 
Single 96-character block. 
purposes of illustration. 


this information could be encoded in a 
It is divided into two blocks for 
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Block length: 15H = 21 
Checksum: 1CH = 28 = 1-5*°6+3-1-0-0-0+2-0+2-... 


r— Object code: 6 bytes 


| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 


L——- Header character 
Figure A-6. 


Tekhex Data Block 


Biock length: 8 
Checksum: 1AH = 26 = 0*8-8-2-+8+0 


~ 


0382 A280 


fs Transfer address: 80H 


| 
| 
| Block type: 8 


Figure A-7. ae 


Header character 
Tekhex Termination Block 


Siock iength’ 37H = 55 


ee Checksum: 60H = (3+7+3+8-28-31+12+28+29+...) mod 256 
Section definition field: 


| t base address = 40H; length = C6H 

id: sok —-~ 

TS736OBSVCSTUTFG2S02C522CR1D14CPEN2Z2501] GREADZ58 1 S¥RITEZ6O | 

SS7SCE8SVCSTUFF ISCLOS E2531 4EXITE7O2SBUFLENGTHZ8013SBUF278 
A el 


4 
| ae Sectior name 
| 
{ 


Block type: 3 


Figure A-8. =a eaeeenraee Heacer character 
Tekhex Symbol Block | 


Copyright 1983, Tektronix: reprinted by permission 


A-16 


APPENDIX B 


REFERENCE MATERTAL 


B.1l GLOSSARY 


argument. An independent variable; the number or numbers that identifies 
the location of a desired value. 


baud. The shortest code element computed to a unit of signaling speed. 
The speed in baud equals the number of code elements per second. 


breakpoint. A point in a program where an external source can intervene 
by giving a specific instruction to interrupt the normal sequence of 
operations. The normal sequence can be resumed after the interruptions 
used for debugging or visual checks on a terminal are terminated. 


default. An option or value that is assumed provided another one has not 
been specified. 


disassembly (disassembler). A program that converts binary instructions 
into their symbolic mnemonic representation. 


don” t care. A term applied to an input or output value that is irrele- 
vant to the specific operation or consideration. 


duplex. Communications in a two-way independent transmission moving in 
both directions. 


‘echo. Part of a transmitted signal recognized and received as interfer- 


ence because of the magnitude and delay of the signal reflected back. 
EEPROM. Electrically Eraseable Programmable Read Only Memory. 
error code. A marking that indicates error by a code. 


host system. The system that controls; for example, the development 
system, minicomputer, or automatic test equipment (ATE) system. 


indirection. The term means indirect addressing; particularly with 
respect to the mechanism that performs it. 


logic state probe (LSA). Monitors a system or component board and shows 
the monitored information to be reviewed. 


mainframe. A reference to large computers to distinguish them from 
microcomputers, microprocessors, and minicomputers. With respect to the 
ES1800 Satellite Emulator, the mainframe houses the emulator, control 
board, RAM Overlay Board, the controller board, the trace and break 
board, the memory control board, and the power supply. 


memory map. A table or drawing representing the memory locations for 
devices, programs, or functions. 


modulo. The result of a mathematical operation of a specified number 
that has been divided leaving a remainder. The remainder equals the 
modulo. 


operator. The element in an operation that defines what action is to be 
performed on the operand. 


parameter. A quantity which may be given variable values. 


parity. A-method of self checking the accuracy of binary number 
transmission. 


run. A term describing the execution of emulation. 


run with breakpoints. The execution of a program with temporary halts to 
permit the operator to make some checks. 


statement. A generalized instruction or syntactically complete string of 
characters. 


step. Single step operation. 


stop bit. One or two l-bits used as a character delimiter in start-stop 
transmission. 


target system. With respect to emulation, the target system is the 
computer (your hardware) that is emulated. 


Trace Memory. Functions as a history of target system program execution. 
XOFF. Transmitter off. 


XON. Transmitter on. 


B.2 REFERENCE MATERIAL 


Table B-l. 
Number Bases Cross 
Reference 
STANDARD 
BINARY OCTAL HEXADECIMAL DECIMAL ABBREVIATION 

0000 0 0 0 

0001 l 1 l 

0010 2 2 2 

OO11 3 3 3 

0100 4 4 4 

0101 | 5 5 

0110 6 6 6 

O1ll 7 7 7 

1000 10 8 8 

1001 ll 9 9 

1010 12 A 10 

1011 13 B ll 

1100 14 C 12 

1101 15 D 13 

1110 16 E 14 

1111 17 F 15 

0001 0000 20 10 16 

0010 0000 40 20 32 

0100 0000 100 40 64 

1000 0000 200 80 128 

0001 0000 0000 400 100 256 

0010 0000 0000 1000 200 512 
0100 0000 0000 2000 400 1,024 1K 
1000 0000 0000 4000 800 2,048 2K 
1100 0000 0000 6000 coo 3,072 3K 
0001 0000 0000 0000 10000 1000 4,096 AK 
0001 0100 0000 0000 12000 1400 5,120 5K 
0001 1000 0000 0000 14000 1800 6,144 6K 
0001 1100 0000 0000 16000 1Cc00 7,168 7K 
0010 0000 0000 0000 20000 2000 8,192 8K 
0010 0100 0000 0000 22000 2400 9,216 9K 
0010 1000 0000 0000 24000 2800 10,240 10K 
0100 0000 0000 0000 40000 4000 16,384 16K 
1000 0000 0000 0000 100000 8000 32,768 32K 
0001 0000 0000 0000 0000 200000 10000 65,536 64K 


NUMBERS 
UPPER CASE LOWER CASE 


@ 
=4 
“” 
QO 
oO 
z 
oa 
P:] 
2 
fe 


r 


001 0 ;2 2 ee nae 22 34 | 32 50 | 42 66 | 52 82 162 98 | 72 114 
23 43 63 103 123 143 163 
ETX a # 3 C Ss c s 
19| 23 35 | 33 51 67 | 53 83 | 63 99 | 73 115 


posal ele aly ale lea al 
% 
25 37 | 35 53 | 45 69 | 55 85 | 65 75 
& 
38 | 36 541 46 70 | 56 86 | 66 102 | 76 
67 107 
: 7 G Ww “< w 
39 | 37 55 | 47 71 | 57 87 |67 103 | 77 119 
70 110 130 150 170 
xX h x 
40 | 38 56 | 48 72 | 58 88 | 68 104 | 78 120 
71 111 131 151 171 
) 9 | Y i y 
41 | 39 57 | 49 73 | 59 89 1/69 ~— 1051] 79 121 
72 112 132 152 172 
, vane: Z j z 
74 1} 5A 106 | 7A 
| 173 
5B |68 107 | 7B 12 


oo 
= 


45 | 3D 61] 40 77 | 5D 93 


76 116 136 
N \ 
1 14) 1€ 30] 2E 46 | 3E 62 | 4E 78 | SE 
ae 137 
15 | 1F 2F 47 |3F 63 | 4F 79 | SF 


Addressed Universal 


V 


—s 


Secondary Addresses 


GPIB code Gommande Conimanes Listen Addresses Talk Addresses or Commands 
ASCII character Table B~2 
decimal ASCIll and IEEE Code 


Chart 


Table B-3. 
ASCII Control Characters 


B-5 


acknowledge 

bell 

backspace 

cancel 

carriage return 

playback on, CNTL Q, X-ON 
record on, CNTL R, PUNCH-ON, SOM 
playback off, CNTL S, X-OFF 
record off, CNTL T, PUNCH-OFF, EOM 
delete, rubout 

data link escape 

end of medium 

enquiry 

end of transmission 
escape 

end of transmission block 
end of text 

form feed 

file separator 

group separator 
horizontal tabulation 
line feed 

negative acknowledge 

null 

record separator 

shift in 

shift out 

start of heading 

Start of text 

substitute 

synchronous idle 

unit separator 

vertical tab 
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APPENDIX C 
SYMBOLIC DEBUG 


C.1 COMMANDS 


C.2 USAGE NOTE FOR USERS WITH SYMBOLIC FORMATS OTHER THAN 
EXTENDED TEKHEX 


C.1 COMMANDS 


The symbolic debug option allows easier debugging, using a wider 
range of capabilities. These include: 


e Reference to an address by a name instead of a value 

e Display of all symbols and sections with their values 

© Editing (entry and deletion) of symbols and their values 

e Automatic display of symbolic addresses during disassembly 


e Section (module) symbols that can be used as range arguments and 
for section offsets in trace disassembly 


e Upload and download of symbol and section definitions using 
standard serial formats 


The only standard symbolic format currently accepted is extended 
Tekhex. If you are using another symbolic format, please see the 
usage note at the end of this appendix. 


e Implicit syabol definition and symbol value change 
> “<SYMBOIL> = <VALUE> 


If SYMBOL is undefined, it is placed into the symbol table and 
assigned the value VALUE. If SYMBOL was previously defined, it 
will be reassigned the value VALUE. 


--<VALUE> is a 32-bit integer value. Don’t cares are not allowed 
in symbolic definitions. 


--<SYMBOL> is any combination of the ASCII characters with decimal 
values in the range 33-126. This range includes all of the 
printable ASCII characters. Symbols are delineated by a single 
starting quote (~) and the first blank space or RETURN. Symbols 
can be up to 64 characters long, although only the first 16 
characters are displayed with symbolic disassembly. 


e Symbolic reference 

> “<SYMBOL> ;GRO = “<SYMBOL> ;~<SYMBOL> + $41900;... 
The reference to “SYMBOL will be exactly like referencing any of 
the common registers in the ES, with the exception that symbols 
not at the end of the command line must be terminated with a 
space. 
e Displaying symbols 

>SYM [VALUE] 
This displays the symbol(s) that have been assigned the value 


VALUE. If no argument is entered, all symbols and their values 
will be displayed. 


e Section definition 
>”“<SYMBOL> = <RANGE> 


Any symbol that is assigned a range value will, by definition, be a 
section. <RANGE> is a standard ES 24-bit range value. 


NOTE: 


Overlapping sections and sections with the same 
name as a symbol are illegal. 


® Display of section values 

>SEC [<VALUE>] 
The gectiou easeuiddas the value will be displayed along with its 
assigned values. If no argument is entered, all section names and 
values will be displayed. 
e Deletion of a symbol or section 

>DEL ~<SYMBOL> nce ae 
This will. remove the symbol or section definition 
e Clearing symbolic memory 

>PUR 
This command permanently removes all symbol data from ES memory. 
e Upload and download of symbolic information 

>UPS 


This command uploads all symbols and sections in extended Tekhex 
format. 


--Sections are defined in separate records. 


--Symbols are defined as belonging to the section "m". 


Extended Tekhex restricts the number and range of characters that 
. can be used for a symbol name. The ES will truncate symbols to 16 
characters and will substitute Z for characters not allowed by 
Tekhex. 


>DNL 
This command will accept symbolic definition records as well as 


data records if the ES download format variable is set to 5 
(extended Tekhex). 


Example C-1. The use of symbols in disassembly allows the ES to display trace 
data in a more useful format. Disassembly with defined symbols 
will display the symbol name everywhere there is an address 
reference that matches the symbol”s value. Section names will be 
shown whenever the program addresses fall within a defined section. 
Also, when in a defined section, the program addresses will be 
displayed as offset values from the beginning of that section. 

. This example outlines these points. The first disassembly contains 
no defined symbols. The second disassembly shows the effect of the 
a symbolic definition. Note how the program address display mode 
changes as the addresses move out of the section. 
>DTE 
SEQ# ADDR OPCODE MNEMONIC OPERAND FIELDS BUS CYCLE DATA 
Figure C-l. Sea Se ee eee ee a ee ae ee 
Disassembly 0069 PQM 8086 80186 Test 
Trace With Symbols 0069 1000 B9ODFOO MOV CX, O0OOF 
0068 1003 BEO020 MOV SI ,2000 
0066 1006 BFO022 MOV DI,2200 
0065 1009 A5 MOVS WORD PTR 2000>FFFO 2200<FFFO 
2” 0064 100A _ F3 REPZ 
= 0064 100B A4 MOVS WORD PTR 
2002>3E 2202<3E 2003>FF 2203<FF 2004>00 2204 
2005>00 2205<00 2006>FF 2206<FF 2007>FF 2207 
‘a 2008>00 2208<00 2009>00 2209<00 200A>FF 220A 
2008>FF 2208<FF 200C>00 220C<00 200D>00 220D 
200E>FF 220E<FF 200F>F5 220F<F5 2010>00 2210 
0063 100C O38100FF ADD AX,WORD PTR [BX-100][D1] 2111>FFOO 
0059 1010 890200 MOV CX ,0002 
0026 1013 F2 REPNZ 
0025 1014 A7 CMPS WORD PTR 201L1>FFI0 2211>FF10 
0025 1015 €116002405 RCL WORD PTR Data Word,05 2400>A002 2400<0 
7 0017 101A C8400004 ENTER 0040.04 
x 17FE<0000 FFFEDFFFF 17FC<FFFF FFFC>FFFF 
17FACFFFF FFFADFFFF 17F8<FFFF 17F6<17FE 
0015 101E EOEO LOOPNE SHORT PGM 8086 80186 Test 
> 
>“Loop = 166 
>“Demon.module = “Loop TO 16C 


>“1/0_port_0 = 3000 
>DT O LEN #10 


SEQ# ADDR OPCODE MNEMONIC OPERAND FIELDS BUS CYCLE DATA 
SEC: DEMON.MODULE 

0009+LOOP 

0009+000000 31C23000 MOVE.W D2,1/0_PORT_0 003000<8787 
0008+000004 D081 ADD.L D1,DO 

0007+000006 64000004 BCC.L $000172 

0006 000172 D885 ADD.L D5,D4 

0005 000174 64FO BCC.S SLOOP 

SEC: DEMON.MODULE 

0004+LOOP 

0004+000000 31C23000 MOVE.W D2,I1/0 PORT 0 003000<8787 
0003+000004 D081 ADD.L DL,DO)t—~—™ 

0002+000006 64000004 BCC.L $000172 

0001 000172 D885 ADD.L D5,D4 

0000 000174 64FO BCC.S SLoop 


> 


C.2 


USAGE NOTE FOR 
USERS WITH 
SYMBOLIC FORMATS 
OTHER THAN 
EXTENDED 

TEKHEX 


ps 
iy 
me 


Of the three methods of entering symbolic data, downloading from 
the host using DNL is preferable since it is not only fast, but 
includes error checking in the transmission of your data. However, 
if you are working with any symbolic format other than Extended 
Tekhex, you will not be able to use this method. Two alternates 
are available: both require that you convert the symbolic format 
that you are using before you enter the symbolic data. 


~ 6 ome 
a heeta t 


e For very small programs, you can enter symbolic data manually 


from a symbol map as follows: 


Ah 
‘T 
hoa 


$255 


><symbol> =<value><returm 


e For other applications, you would want to put the Satellite 
Emulator under computer control, using CCT. This method is just 
as fast as downloading; however, no error checking is performed. 
You must write a program that converts your symbolic data as 
shown above; the program can then transmit the strings to the 
emulator. — 


There are four characteristics to remember about CCT. 


First, the emulator will echo most of the characters sent to it, so 
the computer can use this feature to check the data transmission. 


Second, when the host sends a RETURN, the emulator begins pro- 
cessing the command line. New lines generally begin with RETURN 
LINEFEED NULL NULL. 


Third, the host must be able to handle incoming data at-high rates. 
as the emulator will be sending at 96@@ baud; the host should be 
able to send XON/XOFF to the emulator. 


Fourth, UPL (upload) and DNL (download) expect data from the same 
port whether you are using TCT or CCT: if you are downloading the 
emulator always expects data to come from the host, and if you are 
uploading data is always sent to the host. 


INDEX TO TOPICS (by section number) 
A 


Absolute value, 3.4.3 

AC power connection, 2.3.1 
Activated bit values, 5.3.4 
Address comparators, 5.3.1 
Addition, 3.4.2 

All-cycle trace, 5.1 

Angle brackets, 3.1 
Arithmetic applications, 3.4 
Assemble line to memory, 4.10 
Assembler directives, 4.9 
Assignment operators, 3.4.1 
AT operator, 3.4.1 


B 


Back panel, 2.3.1 

Base values, 3.3 

Baud rate, 2.4.1, 8.2 

Binary base indicator, 3.3.1 
Bit values, 5.3.4 

Bitwise And, Bitwise Or, 3.4.2 
Block move, 4.5.3 

BNC connector, 2.3.l 

Brackets, 3.1 

Break board, 2.4.2 

Break on instruction execution, 3.5 
Breaking emulation, 5.1 
Breakpoint system, 5.1 

BUS, 7.5 

Bus cycle display, 4.8.1 

Byte mode, 4.4.4 


c 


Cables, 1.1.1, 8.1.1, 8.3 

Changing values, 4.2, 4.4.5, 4.5.3, 4.10.4 
Character values for checksum camputation, A.6 
Characters, standard, 3 

Clear memory map, 4.5.2 

Clear to send (input), 2.3.3 

Clock and CRC, 7.4 

Clock signal at power-up, 2.5 

Code space, 4.4.6, 4.5.3 

Camunications, 6 

Comparators, 5.1 

Computer control, 6.3.2 


Computer port, 1.1.3 
Configurations, system, 1.1.4 
Connecting pod assemblies to mainframe, 2.4.2 
Connection to CRT terminal, 2.4.1 
Connection to target system, 2.4.2 
Constants, 4.5.3 

Controller board, 2.3.4 

Copy switch, 3.5 

Count limit, 5.3.2 

Counting events, 5.3.2 

CPU Registers, 4.2 

CRC, 7.4 


D 


Data, moving, 6.4 

Data camparators, 5.3.3 

Data space, 4.4.6 

Debugging, symbolic, C.1l 

Debugging without target system hardware, 4.6 
Decimal base indicator, 3.3.1 

Default base, 3.3.2, 7.1 

Defaults, 2.4.1, 2.6.1 

Delete line, 3.2.4 

Diagnostic functions, 7.1 

Diagnostics, RAM, 7.2 

DIP header, 2.4.2 

Disassemble previous, following trace, 4.8.3 
Disassemble trace, 4.8.2 

Display base, 3.3.3 

Display by bus cycles, 4.8.1 

Display, clear memory map, 4.5.3 

Display disassembled memory, 4.9.1 

Display memory block format, 4.4.7 

Display memory map, 4.5.2 

Display raw trace, 4.8.1 

Display registers format, 4.2 

Displaying block of memory, 4.4.7 

Displaying, clearing event monitor system, 5.2 
Division, 3.4.2 
Documentation, 1.2 
Downloading, 6.4.1, 8.2 
Don't cares, 3.3, 5.3.5 
Dumping data, 6.4.1 
Duplex, default, 2.4.1 


E. 


EEPROM storage, 3.5 

Emulation, 4.3 

Emulation control board, 1.1.1, 2.4.2 

Emulation sequences, sample 2.6.1 
I-2 


Enabling RAM overlay, 4.5.3 
Equal sign, 3.4.1 

Error messages, 4.7 

Errors, download, 6.4.1 
Escape code, 6.4.1 : 
Event detector actions, 5.3 
Event detectors, 5.1 

Event groups, 5.5 

Event monitor system, 5.1 
Examining, changing values, 4.2, 4.4.5, 4.5.3, 4.10.4 | 
Extended Tek Hex, A.6 
External breakpoint, 5.7 
External triggering, 5.7.2 


F. 


Fan, 2.3.2 

Filling memory space, 4.5.3 

Finding memory pattern, 4.4.7 

Force special interrupt, 5.4.1. 3.5 
Formats, data, App. A 

Front, top panel removal, 2.3.4 

FSI on instruction execution, 3.5 
Fuse, line, 2.3.1. 


G 


Glossary, B.1l 
Grounding, 2.2, 2.3.3 
Ground loops 2.2 


H 


Hard copy, see CPY, 3.5 

Help menu, 2.6 

Hexadecimal base indicator, 3.3.1 
Host system control, 6.3.2 


I 


Illegal memory, 4.5.1 

Indirection, 3.4.1 

Installation, 2.1-2.5 

Installing DIP header plug, 2.4.2 

Intel Intellec 8/nds format, A.3 

Interface parameter switch settings, 2.3.4 

Interfacing and camunications, 2.3.4, 6 

Interrupt acknowledge, 5.3.4 

Interrupt, special forced, 5.4.1 

Interrupts, 3.5 

Instruction cycle display, 4.6.1 
=3 


Instruction cycle step, 4.3.2 

Instruction pointer and code segment, 4.2 
Initializing, 4.3.4 — 

Inverse one's complement, 3.4.3 


J 


Line assembler, 4.10 

Line fuse, 2.3.1 

Load parameters and save, 2.6.1 
Load register, 4.2.1 

Load RAM overlay, 4.5.3 

Lockup, 4.3.5, 4.3.6, 6.3.2 
Logic state analyzer, 5.6 


M 


Macros, 4.11 

Mainframe components, 1.1.1 

Main power switch, 2.3.1 

Maintenance and troubleshooting, 8.1 
Mask values, 5.3.4 

Memory block attributes, 4.5.1 
Memory controller board, 2.4.2 
Memory disassembler, 4.10 

Memory map, setting 4.5.2 

Memory mode and I/O pointer, 4.4.2 
Memory mode prampts, 4.4.1 

Memory spaces, 4.4.6 

Memory mode status, 4.4.6 

Modulo, 3.4.2 

MOS technology format, A.1l 

Motorola exorciser format, A.2 
Motorola family support, 1.3 
Motorola S-record output format, A.2 
Multiplication, 3.4.2 


N 

Negation and two's camplement, 3.4.3 

Null modem cable, Set-up Checklist, 2.3.3 
Numbers and base values, 3.3 

Number bases cross reference, B.2 

0 


Octal base indicator, 3.3.1 
I-4 


Odd boundaries, 5.3 

ON and OFF, 3.5 
Oscilloscope trigger, 2.3.1. 
Options, 1.4 


P 


Parameter set-up and EEPROM storage, 2.6.1 
Parentheses and indirection, 3.4.1 
Parity, 2.4.1 

Parts list, 8.3 

Pass counting, 5.1, 5.3 

Patching data, 4.4.5, 4.10.4 
Patching instructions, 4.10 

PCB information, 4.2.1.1 

Pin signals, serial ports, 2.3.3 
Pod, emulator, 1.1.1, 2.4.2 

Pod, LSA, 1.1.1, 2.4.2 

Pointer, instruction, 4.2 

Ports, 2.3.1, 2.3.3 

Power connection, 2.3.1 

Power supply, 1.1.1, 1.5 

Power switch, 2.3.1 

Power-up, 2.5 

Pre-emulation check list, 2.6 
Prompts, 3.2.1, 4.4.1, 5.3.1 


R 


RAM diagnostics, 7.2 

RAM overlay board, 1.1.1 

RAM overlay, 4.5.3 

Range values, 3.3 

Read only memory, 4.5.1 
Read/write memory, 4.5.1 
Rear panel, 2.3.1 

Registers, loading, 4.2.1 
Registers, general, 4.2.2 
Register operators, 4.2 
Repeat function, 4.11 

Repeat previous canmand line, 3.2.4 
Reprint previous line, 3.2.4 
Request to send (output), 2.3.3 
Resets, types, 4.3.5 

Return character, 3.2.4 
RS232 pin conventions, 2.3.2 
Run prompt, 3.2.2 

Run, 4.3.1 

Run with breakpoints, 4.3.3 
Run with vectors, 4.3.4 
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S 


S-record information, App. A 
Scope loops, 7.3 
Scrolling, 2.6.1, 4.4.3 
Separators, 3.2.4 

Serial data formats, Appendix A 
Serial data in and out, 2.3.3 
Serial port connector pin assignment, 2.3.3 
Serial ports, 2.3.1, 2.3.3 
Service, 1.7. 8.1-8.3 

SET select numbers, 2.6.1 
Setting up, 2.1-2.5 | 

Shift left, shift right, 3.4.2 
Side panel, 2.3.2 

Signetics absolute object format, A.4 
Single-argument operators, 3.4.3 
Single-step, 4.3.2 

Spacing, 3.2.3 

Specifications, 1.5 

Square brackets, 3.1 

Standard characters, 3 
Standalone system, 1.1.4 
Standard characters, 3 

Status comparators, 5.3.4 
Status mnemonics, 5.3.4 

Step and stop, 4.3.2 

Stepping through program, 4.3.2 
Stop bit, 2.4.1, 6.2 

Strobe, timing, 5.6.2 
Subtraction, 3.4.2 

Switch settings, 2.6.1, 3.5 
Symbolic debugging, App. C 
System configurations, 1.1.4 
System parameters, defaults, 2.6.1 
System syntax, 3 


T 


Target memory accesses, 4.5.1 
Target system, 1.1.2. 

Tektronix hexadecimal format, A.5 
Terminal control, 6.3.1 
Thumbwheel switch, 2.3.4 

Timing strobe, 5.7.2 

Toggle counting, 5.4 

Toggle tracing, 5.4 

Trace and break board, 1.1.1 
Trace memory and disassembly, 4.8 
Tracing software sequences, 4.8 
Transparency, 1.1 

Transparent mode, 6.3.3 
Triggering outputs, 5.7.2 
Troubleshooting, 8.2 


Two-argument operators, 3.4.2 


U 


Unpacking, 2.1 

Upload and download, 6.4.1 
Utility operators, 3.2.4 
Utility routines, 7 


V 

Values, examining, changing, 4.2, 4.4.5, 4.5.3, 4.10.4 
Vectors, loading, running with, 4.3.4 

Verify download, 6.4 

Verify block data, 4.5.3 

Verify block move, 4.5.3 

Verify RAM overlay memory, 4.5.3 

Voltage, 2.2 

W 

Wait, 4.3.6 

Warranty, 1.6 
When/then statements, 5.1, 5.3, 5.3.2, 5.4, 5.5 
Windowing, 5.4 

Word and Byte Mode, 4.4.4 

Xx 


XON, XOFF, 2.4.1, 6.2 


Y 
Z 


Zilog family support, 1.3 
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